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SECTIC»} 1 


INTRODUCTION 


Recently, there has been much interest in the problem of restructur- 
ing the control law of aircraft following the failure of control surfaces 
or actuators (References 1,2,3). This interest is motivated in part by 
two incidents involving commercial aircraft. In the case of Delta flight 
1080 on April 12, 1977, the left elevator became stuck in the 19® up 
position at takeoff (Reference 4) • The pilot was able to compensate for 
the failure, in part by manipulating thrust to control the pitch axis. 
However, the pilot of the DC1 0 that crashed in Chicago (Reference 5) was 
unable to recover from the left engine breaking loose and the resulting 
retraction of the left wing's outboard leading edge slats. Simulations 
indicate that the aircraft could have been flown if impending stall con- 
ditions had been recognized and the proper corrective action taken. 
Restructuring the control system on-line to counteract the effect of 
these failures may be one solution to such problem situations. Although 
the need for res true turable control has been demonstrated for state-of- 
the-art aircraft systems, it can be expected to be most applicable to 
future aircraft where redundant control surfaces will very likely be 
extensively employed. 

A feasible and practical restructurable control system requires the 
correct and timely detection and isolation of the control system failure 
so that the proper corrective action can be taken. The evaluation of 
various failure detection and isolation (FDI) algorithms for application 
in aircraft restructurable flight control systems is the focus of this 
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interim report* The work described was conducted by the Charles Stark 
Draper Laboratory, Inc. (CSDL) for the NASA Langley Research Center under 
contract NASI -17556 entitled, "Evaluation of Failure Detection and Iden- 
tification Techniques for Application in Aircraft Res true turable Control 
Systems." The specific goals of this effort are twofold: 

o To analyze and compare various failure detection and identifica- 
tion techniques to determine their usefulness in detecting and 
identifying failures in an aircraft flight control system, exclud- 
ing sensor and flight control computer failures. Issues such as 
the types of failures which can be detected, the degree of failure 
that can be detected, the time delay between failure and detec- 
tion, etc. are to be addressed. This evaluation should also 
consider the maturity, reliability, false alarm performance, 
robustness and computational burden of each technique. 

o To develop a system monitoring strategy to implement the failure 
detection and identification techniques. This strategy should 
identify the mix of sensors and analytic redundancy; that is, the 
mix of direct measurement of failures versus the computation of 
failures. 

Three specific FDI algorithms were evaluated under this study; the 
detection filter, the Generalized Likelihood Ratio test and the Orthogon- 
al Series Generalized Likelihood Ratio test. The detection filter 
(References 6,7,8) has the form of an observer, much like that of a Kal- 
man filter. The feedback gain matrix is chosen so that each type of 
failure produces a uniquely defined residual. The FDI system is there- 
fore insensitive to the mode of the failure, be it bias, ramp, etc. A 
shortcoming of the detection filter is that its application to time- 
varying systems is limited. 

Basic detection filter theory assumes a system with no direct 
input-output coupling. This assumption is violated in the aircraft 
application considered in this study due to the use of acceleration 
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measurements for detecting and isolating failures. With this coupling, 
residuals produced by control surface failures may only be constrained to 
a known plane rather than to a single direction as in the case of the 
basic detection filter. A detection filter design with such planar fail- 
ure signatures is considered and the design issues associated with it 
addressed, in addition, a modification to the basic detection filter, to 
constrain the residual to a single known direction even with direct 
input-output coupling, is also presented. The approach employed is to 
use secondary filtering of the detection filter residuals to produce 
unidirectional failure signals. 

The Generalized Likelihood Ratio (GLR) test (Reference 9) is derived 
based upon the assumption of a step failure. The magnitude of the 
failure and its time of occurrence are estimated using maximum Likelihood 
Estimation. These estimates are used to form a likelihood ratio which is 
the test statistic. 

The third algorithm investigated is the Orthogonal Series General- 
ized Likelihood Ratio (OSGLR) test (Reference 10). This algorithm 
assumes a failure in the form of a truncated series of orthonormal basis 
functions. The coefficients of the series expansion are estimated using 
maximum likelihood estimation and a generalized likelihood ratio is 
formed using these estimates. The rationale for adopting this approach 
is that most failures should be represented fairly well using a truncated 
orthogonal series expansion and this algorithm should be more robust to 
failure mode uncertainty than the conventional GLR test. 

The three algorithms just described were evaluated by testing their 
ability to detect and isolate control surface failures in a nonlinear 
simulation of a C-130 transport aircraft. Elevator, rudder, aileron and 
flap failures were investigated. 

This report is organized as follows. Section 2 describes the C-130 
and simulation used to evaluate the FDI algorithms under consid- 
eration. Basic detection filter theory and its application to restruc- 
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turable control is addressed in Section 3, while the modified version of 
the detection filter is discussed in Section 4. Both GLR tests are 
evaluated and compared in Section 5* It was found during the course of 
this study that failures of some aircraft controls are difficult to 
distinguish because they have a similar effect on the dynamics of the 
vehicle. Quantitative measures for evaluating the distinguishability of 
failures are considered in Section 6. Section 7 is devoted to a compari- 
son of the FDI algorithms considered based upon their ability to detect 
and isolate failures in aircraft systems in general and the C-130 in 
particular. Considerations in the development of a system monitoring 
strategy in a transport aircraft are discussed in Section 8. The 
material described in the report is summarized and the major conclusions 
presented in Section 9. Appendix A includes a description of the method- 
ology employed to develop the linear model of the C-130 aircraft required 
for each of the FDI algorithms. The discrete time version of the 
detection filter is briefly described in Appendix B. 


4 



SECTION 2 


C-130 SIMULATION DESCRIPTION 


2.1 Introduction 

The FDI algorithms under consideration will be evaluated by 
testing their ability to detect and isolate control surface and flap 
failures that have occurred in a simulation of a Lockheed C-130 air- 
craft. The C-130 aircraft is a military, medixam- to long-range transport 
propelled by four turboprop engines located on a high wing. The particu- 
lar version of the C-130 aircraft used for this program has short takeoff 
and landing (STOL) capability provided by trailing-edge double-slotted 
flaps. 


2.2 Simulation Description 

The simulation of the C-130 aircraft uses the standard six 
degree-of -freedom aircraft nonlinear equations of motion. The aero- 
dynamic forces cuid moments are described by one-, two-, or three- 
dimensional look-up tables. These look-up tables are functions of angle 
of attack, sideslip angle, thrust, flap deflection, or the control sur- 
face deflections. Each of the four engines are assumed to provide the 
same thrust. Actuator dynamics have been included; however, sensor 
dynamics were not included. 

The surfaces available for control of the aircraft are the 
ailerons, flaps, rudder and elevator. The simulation allows for 
independent motion of the left and right ailerons and the left and right 
flaps so that failures of these individual surfaces could be simulated 
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and used along with rudder and elevator surface failures to evaluate the 
performance of the FDI algorithms. Since aileron and flap failures are 
similar in their effect on the dynamics of the vehicle, detecting and 
isolating aileron and flap failures should provide an adequate test for 
the various algorithms to be evaluated. 

The eleven measurements available for detecting and isolating 
failures are those typically available onboard aircraft. These measure- 
ments are listed in Table 2.1, along with the six control inputs 
described above and the ten states that describe the aircraft dynamics. 
The measurements are generated in the simulation by superimposing 
zero-mean Gaussian distributed noise on the output variables. The noise 
statistics used for this study are shown in Table 2.2. 

Wind turbulence is also incorporated in the simulation. The 
turbulence velocity along each body axis is modeled by passing white 
noise through shaping filters to produce signals with desired one- 
dimensional power spectral densities. The Dryden form of the spectra, 
defined in Reference 11, is modeled. This reference suggests am 
intensity of 1 .98 m/s (6.5 ft/s) for clear air turbulence at the altitude 
of 304.8 m (1000 ft) used in this evaluation. However, this level 
characterizes severe turbulence and a less severe level was selected for 
initial evaluation. Therefore, an intensity of 0.3 m/s (1 ft/s) was used 
to obtain the results presented in this report unless otherwise noted. 

The turbulence scale lengths were the clear air values defined in Section 
3. 7. 3. 2 of Reference 11. 

Each of the FDI algorithms evaluated requires a linear model of 
the system. Appendix A includes a discription of the methodology 
employed to develop the linear model of the C-130 aircraft for this 
purpose. 
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Table 2,1 . Inputs, Outputs, and States of the C-130 Aircraft 


Inputs 

Elevator 
Right aileron 
Left aileron 
Right flap 
Left flap 
Rudder 

Outputs 


Airspeed 

Acceleration at the eg along the y body axis 
Acceleration at the eg along the z body axis 
Angular velocity about the x body aucis^ 
Angular velocity about the y body axis^ 
Angular velocity about the z body axis^ 

Roll 

Pitch 

Yaw 

Altitude rate 
Altitude 

States 

Airspeed 
Sideslip angle 
Angle of attack 

Angular velocity about the x body axis^ 

Angular velocity about the y body axis^ 

Angular velocity about the z body axis^ 

Roll 

Pitch 

Yaw 

Altitude 


1 Will be referred to as body axis roll rate. 

2 Will be referred to as body axis pitch rate. 

^ Will be referred to as body axis yaw rate. 
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Table 2.2« Standard Deviation of Sensor Noise 


SENSOR 

STANDARD DEVIATION 

Airspeed 

3.35 m/s 

11 ft/s 

Accelerometers 

•3 m/s^ 

.98 ft/s^ 

Roll Rate Gyro 

•0024 rad/s 

•1375 deg/s 

Pitch and Yaw Rate Gyros 

•0007 rad/s 

•04 deg/s 

Attitude Gyros 

•01 radians 

•573 degrees 

Altitude Rate 

• 08 m/s 

.25 ft/s 

Altitude 

3.05 m 

10 ft 
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SECTION 3 


THE DETECTION FILTER 


3*1 Detection Filter Review ^ 

The evaluation of the basic detection filter is considered in this 
section* A block diagram of a nonlinear system and its detection filter 
is shown in Figure 3*1 • For this study the actuator dynamics were 
assumed to be modeled perfectly* Therefore, the control surface deflec- 
tions of the nonlinear system, J£(t), and the control surface deflections 
input to the detection filter, ^*(t), are equal unless an actuator fail- 
ure has occurred* A linear model of the system in its nominal operating 
condition is incorporated in the detection filter. Note that there is no 
direct coupling between the inputs and the outputs* (Direct input- to- 
output coupling will be considered in Section 3.2.) Any discrepancy 
between the system sensor outputs and the simulation of those outputs 
generated by the filter model is fed back to the filter input through the 
gain matrix K* One of the requirements on the design of the detection 
filter is that K be chosen to make the filter stable* Thus, as long as 
the system remains in its nominal operating condition, any initial condi- 
tion errors of the filter will die away and the filter will track the 
behavior of the system. The output error, r{t) , is in that case zero 
except for disturbances, noises, or other real system effects not modeled 
in the filter* 
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Much of this detection filter description is taken from Reference 
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MAY BE NONLINEAR. 








If one of the system components fails, the actuator models or the 
filter no longer model the actuators, the system, or the sensors accu- 
rately. It is clear, then, that the output error will be significantly 
different from zero following the failure of a system component. This 
would be true of any filter v^ich models the nominal system; it would be 
true, for example, of a Kalman filter which estimates the state of this 
system. But the failure detection filter is designed under a different 
set of constraints than other filters; it is designed to hold the output 
error corresponding to any one component failure in one direction only. 
Thus a component failure is detected by observing a significant magnitude 
in the output error; the failed component is identified by observing the 
direction of that significant error in the space of r(t). 

Perhaps the most important advantage of this approach to FDI is that 
the behavior described above does not depend in any way upon the mode of 
the component failure. Many other forms of FDI are tuned to hypotheses 
about the mode of component failures. But in most cases one cannot real- 
istically expect to enumerate a comprehensive list of possible failure 
modes and characterize somehow the behavior of the component following 
each of those modes of failure. Although the specification of this kind 
of information is, in principle, useful and may be expected to permit 
more sensitive failure detection, the uncertainties involved in specify- 
ing failure mode information may more than offset such a potential 
advantage. No assumption with regard to the mode of failure will be made 
in this section. 

The theory of the failure detection filter, in its present state, 
applies to a linear, time-invariant system. In its application to air- 
craft the inherently nonlinear behavior of the vehicle will be linearized 
and any discrepancy between the actual system and the model of it in the 
filter will produce an output residual which contributes to the back- 
ground against which the output due to failures must be detected. The 
continuous -time development is presented in this section. As the 


11 



detection filter will actually be implemented in a digital computer, the 
extension to discrete-time is stated in Appendix B. 

3.1.1 System and Filter Models 

The linear, continuous-time analytic model of the perturbations 
about the operating point of the nonlinear system may be written in the 
form 

(3.1 ) 

(3.2) 

Here x^ is the state vector characterizing the system, u is the input or 
control vector and is the vector of measurements available from the 
system sensors. This development will not consider the effect of noises 
disturbing the system nor corrupting the measurements. Those effects 
will be evaluated in a simulation of the system with its detection 
filter. Note that the delta (A) notation for the linear state, input, 
and measurement vectors used in Figure 3.1 has been dropped for conven- 
ience. This notation change produces an ambiguity in that the same 
symbols are used for both the nonlinear and linear state, input, and 
measurement vectors. However, as detection filter theory is limited to 
linear systems, the symbols should be understood as referring to the 
linear state, input, cind measurement vectors. 

As seen in Figure 3.1, the detection filter state and residual 

satisfy 

X’ - Ajc' + Bju' + K£ (3.3) 

£ = L- L' (3.4) 

where 

X' = ex' (3.5) 


X = Ax + BiJ 
y = Cx 
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This £ is the accessible output error. Define in addition the full state 
error 


3 . = £ ■ 21 ' ( 3 * 6 ) 

In the absence of failures, and supposing that the filter has an accurate 
model of the system, this error satisfies the differential equation 

• • • 

q = X - X* 

= (A - KC)q (3.7) 

One of the requirements on the design of the detection filter is that K 
must be chosen to make (A - KC) stable. Thus even though the filter may 
not be initialized to match the system initial conditions, the error will 
die out and then 2 £’(t) will track 3c(t)# So a detection filter is a state 
estimating filter, but that is not its primary purpose. 

3.1.2 Model of a Failure 

First consider an actuator failure. In Bq. (3.1) each element of 
^ relates to one actuator. Thus the corresponding column of B expresses 
how that actuator drives the system state. Call the column of B corre- 
sponding to the ith actuator b,. If that actuator fails, u.(t) will not 
behave as expected. This can be modeled by changing Eq. (3.1) to 

X = Ax + Bu* + b^n(t) (3.8) 

where n(t) is an arbitrary scalar function of time expressing the differ- 
ence between what the failed actuator is doing and what the nominal model 
says it should be doing. If, for example, an actuator fails by sticking 
in the zero position, then n(t) = - ^Mt) where ^|(t) is the expected 
actuator position time history. The fact that n(t) is treated as an 
arbitrary function is the mathematical expression of the fact, cited 
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previously, that we will not depend on any information about the mode of 
component failures. 

With the system behavior given by Bq# (3.8) and the detection 
filter characterized by Eq, (3.3), the error in the presence of an 
actuator failure obeys the differential equation 

q = (A - KC)q + b^n(t) (3,9) 


The output error is then 


r = y y' 


= Cq 


(3.10) 


In addition to making the filter stable with favorable transient charac- 
teristics, K is designed to restrict the response of Eq. (3.9) to a sub- 
space of the full space of q, which has a projection through C to the 
output space having one dimension only. This property is independent of 
n(t) and depends only on the vector b^, which gives the direction in 
state space in which the failed actuator drives the state error. The 
component whose failure is to be detected is therefore characterized, for 
the purpose of detection filter design, by b^. It is called the event 
vector for this particular failure. Any scalar multiple of b^ can be 

used as its magnitude is of no consequence; it is the direction of b 

-i 

that is important. 

If it is possible to design a detection filter that restricts the 
output error (residual) due to the failure event b^ to one dimension, the 
direction of the residual will be Cb^. Only if the Cb. corresponding 
to all the b^ assigned to one detection filter are linearly independent 
can their output errors be restricted to single, orthogonal directions in 
the output space or in any transformation of the output space. If the 
Cb^ are not linearly independent, one may wish to remove one or more b^ 
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from the group to achieve independence. This limits the number of 
failures which can be identified by one filter to the number of 
independent measurements which are available. 

However, there is one exception to the above. If any b^ as first 
defined has the property 


Cb. = 0 

-1 


(3.11 ) 


then that event vector should be replaced by b!^, vdiich is the first 
vector in the sequence 





Ic — 1,2,... 


(3.12) 


for which 



t 0 


(3.13) 


In the above discussion it was assumed that this redefinition of b, has 
been made whenever necessary, and the resulting event vector was still 
referred to as b. for convenience. 

-X 

In the case of a sensor failure, for a sensor whose output is not 
fed back through a controller to the system input, the modeling is very 
similar but the effect is more complex. In the output expression, 

Eq. (3.2), each element of ^ is one sensor output. The corresponding row 
of c determines the linear combination of states which characterize that 
measurement. If the ith sensor fails, the result is modeled as 

y = Cx + v^n(t) (3.14) 

where again n(t) is an arbitrairy scalar function and v^ is a vector whose 
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elements are zero except for the ith which is 1 • This represents an 
arbitrary discrepancy between the sensor output after failure and the 
nominal output. The filter error in this case obeys the relations 

q = (A - KC)q - k^n(t) (3.15) 

£ = Cq + y^n(t) (3.16) 

The arbitrary function n(t) appears both at the input to the error dif- 
ferential equation and in the output relation. The input direction, k^, 
is in this case the ith column of the detection filter gain matrix, K. 

As in the case of actuator failures, it may be possible to restrict 
the residual produced by the k^n(t) term to a single direction. For the 
sensor failure case, the direction would be Gc^. However, in general, 
this direction will not be the same as the direction which appear di- 
rectly in the residual expression, Eq. (3.16). Thus the residual, in the 
case of failures of sensors which do not feed back into the system 
through a controller, can be restricted to a plane but not a line. This 
plane is defined by the vectors Ck. and v. . 

-1 -X 

Failures of sensors whose output is fed back through a controller to 
the system input may be modeled in the same manner as actuator failures 
(Eq. (3.8)). This is true also for significant changes in system 
dynamics corresponding to changes in the elements of A or B. For these 
cases, b^ is no longer necessarily a column of B but a general event 
vector which appropriately models the failure. As in the case of actua- 
tor failures, the residual produced by these failures may be restricted 

to a line defined by Cb. . 

-1 


3*2 The Effect of Explicit Coupling of Inputs to Outputs 

The development of the detection filter to date, as discussed in 
Section 3.1, has assumed that there is no direct coupling between the 
inputs and the outputs. However, there is direct input-output coupling 
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due to the lateral and normal acceleration measurements available on- 
board the C-130 aircraft chosen for use in this study. This coupling 
results in a nonzero D matrix in the linearized system model: 

(3.17) 

(3.18) 

The effect of this coupling on actuator failure signatures will be 
presented here. Only actuator failures are considered since this is the 
type of failure of interest in the Res true turable Controls Program. 

Consider a failure in the ith actuator. The actual control 
surface deflections, \i(t), can be expressed as the sum of the expected 
control surface deflections input to the detection filter, ii'(t), 6md the 
difference in the actual and expected ith control surface deflection 
n(t) . 


X = Ax + Bu 
2 = Cjc + Dll 


u(t) = u'(t) + e^n(t) (3.19) 

e^ is a column vector with zeros in every row except for a one in the ith 
row. As before, no assumption has been made with regard to the actual 
form of n(t). A model of the effect of the failure on the system is 
developed by substituting Eg. (3.19) into Eqs. (3.17) and (3.18). 

X = Ax + Bu' + b^n(t) (3.20) 

y = Cx + Du' + d^n(t) (3.21) 

Here, d. is the ith column of the D matrix. The differences between 
-1 

the actuator failure model with input-output coupling and the model with- 
out coupling are the two D matrix terms in the measurement equation. 
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The detection filter is still of the form given in Eqs, (3.3) and 
(3.4). These equations are repeated here for reference. 

x' = 1^* + + K£ 

r = y - y* 

However,, the expression for now contains a nonzero D matrix term 

y* = Cx* + Du' (3.22) 

Given the system behavior in response to an actuator failure (Eqs. (3.20) 
and (3.21)) and the detection filter equations (Eqs. (3.3), (3.4) and 
(3.22)), the error dynamics of the filter are found to be 

q(t) = (A - KC)q(t) + (b^ - Kd^)n(t) (3.23) 

r(t) = Cq(t) + d^n(t) (3.24) 


(3.3) 

(3.4) 


These error dynamics are similar to the error dynamics produced by a 
detection filter wi thout input-output coupling in response to a failure 
of a sensor whose output does not feedback into the system through a 
controller. The unexpected control surface deflection appears both at 
the input to the error differential equation and in the residual 
equation. It may be possible to restrict the residual produced by 
(b^ - Kd^)n(t) term to a single direction C(b^ - Kd^ ) . But as this 
direction differs, in general, from the d^ direction, which also appears 
in the residual equation, the failure signature will be planar. This 
plane is spanned by the vectors C(b. - Kd. ) and d. . Notice that the 

-1 -X -1 

gain matrix K has an effect on the direction C(b, - Kd. ) and therefore 

-1 -1 

on the resultant plane. A unidirectional residual would result if the 
direction of C(b. - Kd. ) could be aligned with d. • 

-1 -X -X 
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However, aligning 



with would not allow the failure to be distinguishable in 
this application as there are only two distinct directions of the columns 
of D (there are only two measurements which produce nonzero entries in 
the D matrix). Therefore, without basic modification of the detection 
filter, the effect of input-output coupling is to cause actuator failure 
signatures to be planar instead of unidirectional. 

This result prompted a re-examination of the use of the acceleration 
measurements. However, it was decided not to substitute angle of attack 
and sideslip angle measurements for the acceleration measurements as the 
acceleration measurements are of higher quality. This decision limited 
the remaining options to two: testing a detection filter with the planar 

signature property or modifying the detection filter to regain the 
property of unidirectional actuator failure signatures. Both of these 
options were developed and tested. The results of the planar signature 
detection filter are shown in Section 3.5. The modification of the 
detection filter and the results obtained using this filter will be 
presented in Section 4. 

3.3 Detection Filter Design 

A detection filter is designed by calculating the gain matrix so 
that actuator failures produce unidirectional residuals in the case of no 
direct input-output coupling or planar signatures when there is direct 
input-output coupling. This desired residual behavior may be produced 
for a fully measured system (i.e., rank [C] equals the number of states) 
by choosing K such that, for some X, 

A - KC = XI (3.25) 

As the measurement set chosen for this evaluation is such that the system 
is fully measured, this design approach will be used. The filter eigen- 
values can be seen to be the eigenvalues of (A - KC) by rewriting Eq. 
(3.3). 
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X* = (A - KC)3C' + Bu’ + K(^ - Du*) (3.26) 

Thus the eigenvalue X should be chosen to give a stable filter that has 
acceptable transient response characteristics. 

3.3.1 Design Procedure 

Using the previous approach, the following procedure can be used 
to design a detection filter: 

(1) Choose the measurement scaling. 

(2) Select the filter eigenvalue X. 

(3) Calculate the gain matrix. 

(4) Set thresholds. 

Each of these steps will now be discussed in more detail. 

Measurement scaling was used to reduce the effect of noisy measure- 
ments and enhance the contribution of higher quality measurements. 

Scaling the measurements effectively changes the numerical values of the 
standard deviation of the noise. 

The next step is to choose the filter eigenvalue. One obvious 
requirement is that the eigenvalue be chosen so the filter is stable. In 
addition, it is desirable to make the filter fast, so as to reduce the 
effect of modeling errors and to have short failure detection times. 
However, a fast eigenvalue also reduces the magnitude of the residual 
produced by a failure, making detection more difficult in a noisy envi- 
ronment. If noise is a problem, though, it might be better to low-pass 
filter the residual instead of making the filter slower. This supplemen- 
tal noise filtering can be employed in such a way that the quick detec- 
tion of a large failure is not sacrificed for the detection of smaller 
failures. This is achieved by passing the residual through a bank of 
parallel low-pass filters with different time constants. One such filter 
would have a small time constant to allow for quick detection of large 
failures while other filters would have larger time constants to allow 
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for detection of moderate and small failures. The filter eigenvalue 
chosen for this evaluation was approximately twice as fast as the fastest 
eigenvalue of the system. 

The final two steps are to calculate the gain matrix and to set 
detection and isolation thresholds. The gain matrix calculation will be 
discussed below. While selecting thresholds is an important aspect of 
detection filter design, thresholds will not be selected in this study as 
the algorithms will be evaluated qualitatively. 

3.3.2 Gain Matrix Calculation 

Given choices for scaling and the filter eigenvalue, actual calcu- 
lation of the gain matrix to satisfy the equality shown in Eq. (3.25) is 
still uncertain in this application because there are eleven measurements 
and only ten states. K is underdetermined as there are ten more unknowns 
than equations in satisfying Bq. (3.25). Recall that in order to be 
guaranteed that Eq. (3.25) can be satisfied, the rank of C must be equal 
to the number of states. Therefore, one measurement could be elimina- 
ted such that the rank of C remains ten. in this case, the gain matrix K 
would becompletely determined by constraining A - KC to be the diagonal 
matrix XI. However, eliminating a measurement just to simplify the gain 
matrix calculation seemed undesirable since information is thereby lost, 
and this approach was not taken. In addition, the ten degrees of freedom 
remaining in the gain matrix after Bq. (3.25) has been satisfied might be 
useful in separating the failure signature directions C(b^ - Kd^) if 
their effect on these directions were known. 

Two techniques for choosing K were explored: (1) the augmentation 

of A - Xl and C each with one column prior to solution by matrix inver- 
sion, cuid (2) the minimum norm column solution of K. The first technique 
was used in a rather ad hoc manner since there is at present no system- 
atic approach to constraining the degrees of freedom. The purpose of 

2 

Note that the rank of C cannot be greater than the number of states. 
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augmenting C with a column, is to make the matrix invertible* This 
places the restriction on the column £ that it be independent of the 

columns of the matrix C* The matrix A - XI must be augmented with a 

column £ in order to have the multiplication by the inverted augmented C 
matrix dimensionally correct. The solution for the gain matrix is then 

K = [A - XI • ^] [C • £]"^ (3.27) 

A detection filter designed using this approach is evaluated in the 
following sections. 

A second technique for obtaining the filter gain matrix is to use 
the pseudo inverse or generalized inverse (Reference 13) of C, C**", to 
calculate the gain matrix K whose columns are the minimum norm solutions 
of the equality Eq. (3.25). Here, K can be calculated 

K = (A - \L)C^ (3.28) 

Note that this technique avoids explicit assignment of the twenty 
parameters in the augmentation approach. But imposing this minimum norm 
constraint on the ten fundamental degrees of freedom ultimately also 
lacks theoretical justification. A detection filter design using this 
approach will also be examined in the following section. 

3.4 Test for Planar Failures 

As described in Section 3.2, the plane in which the signature for 
a failure of the ith control surface lies for the detection filter is 
determined by the vectors C(b^ - ^ possible failure detec- 

tion and isolation test is to calculate the orthogonal projection onto a 
particular failure plane. Then, the control surface associated with that 
failure plane would be identified as failed if the magnitude of the 
projection is greater than some threshold. If, however, one is willing 
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to make a slightly restrictive assumption about the form of the surface 
failure, it is possible to restrict the failure signature for a given 
control surface to two segments of the plane. The assumption is that the 
unexpected control input, n(t), be either always positive or always nega- 
tive. The advantage of restricting the failure signatures to two plane 
segments is the failures should be more distinguishable; the disadvantage 
is that failures where n(t) is changing sign frequently may be difficult 
to detect. The initial evaluation of the detection filter only 
considered constant bias failures. For this subset of failures, n(t) was 
either positive or negative. Therefore, the planar test discussed below 
assumes that the failure signature for a given control surface is 
restricted to either of two plane segments. 

Before discussing this test, however, the two plane segments must 
be defined* These failure signature plane segments can be determined by 
examining Eqs. (3,23) and (3.24). These equations for the state 
estimation error and the observation residual are repeated here for 
convenience , 


q(t) 

= (A - KC)q(t) + (b^ - Kd^)n(t) 

(3.23) 

r(t) 

= Cq(t) + d^n(t) 

(3.24) 


Consider first the case where n(t) is positive. As described in Section 
3,2, the (b^ - Kd^)n(t) term in Bq, (3,23) would produce a unidirec- 
tional residual along C(b^ - Kd^), except for the presence of the addi- 
tive d^n(t) term in the residual equation. Therefore, the failure signa- 
tures for n(t) positive will lie in the segment of the plane defined by 
the vectors C(b^ - Kd^) and d^ (See Figure 3.2), For n(t) negative, the 
residual directions produced by the failure will be the negative of the 

vectors C(b. - Kd. ) and d. . Therefore, the failure signatures for n(t) 

-1 -1 -1 

negative will lie in the segment of the plane defined by the negative of 
the vectors C(b. - Kd. ) and d. , 
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The test to detect and isolate planar failures in this evaluation 
is the projection of the residual onto the two plane segments defined in 
Figure 3.3# This test is similar to the test described for sensor 
failures in Section 4«3«2 of Reference 8* The residual projection, in 
the case when the orthogonal projection of the residual onto a particular 
failure signature plane lies in either of the two plane segments, is 
simply the orthogonal projection onto the plane or the negative of the 
orthogonal projection* If the orthogonal projection lies outside these 
two plane segments, the residual projection is the projection of the 
residual or the negative of the projection onto the closest of the 
normalized C(b^ - Kd^), d^, -C(b^ - Kd^), or -d^. 

3.5 Detection Filter Results 

To design and test the detection filter, a single cruise flight 
condition at an altitude of 304.8 m (1000 ft) and an airspeed of 77.2 
m/s (150 knots) was chosen. First, the specific choices made in 
designing the detection filter will be discussed, and then the simulation 
results produced by this filter will be presented. 

As described previously in Section 3.3, the design of a detection 
filter was broken into three steps: 

(1) measurement scaling selection 

(2) eigenvalue selection 

(3) gain matrix calculation 

The measurements were scaled to have the units shown in Table 3.1, 
reducing the reliance of the detection filter on the airspeed and normal 
acceleration measurements in detecting and isolating failures and accen- 
tuating the contribution of the angular velocity and attitude measure- 
ments. The normal acceleration measurement was seriously affected by the 
turbulence while the angular velocity and attitude measurements were of 
better quality than the other measurements. In addition, the airspeed 
measurement was very noisy. 
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PLANE SEGMENT 
CORRESPONDING TO n(t) > 0 


o 



Figure 3.3. Detection filter planar test 



Table 3*1 • Measurement Units for Unmodified 
Detection Filter Evaluation 


MEASUREMENT 

UNITS 

Airspeed 

7 .6 m/s 

25 ft/sec 

Lateral Acceleration 

0.3 m/s^ 

ft/sec^ 

Normal Acceleration 

1.5 m/s 

5 ft/sec^ 

Angular Velocity 

•0175 rad/sec 

deg/sec 

Atti tude 

.0175 rad 

degrees 

Altitude Rate 

0.3 m/s 

ft/sec 

Altitude 

0.3 m 

ft 
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The detection filter eigenvalue was chosen to be approximately 
twice as fast as the fastest eigenvalue of the system* Specifically, the 
discrete-time eigenvalue chosen was 0*95. For the sample time of 20 ms 
used in the simulation, .95 corresponds approximately to an eigenvalue of 
-2*6 (a time constant of *4 s) in continuous-time domain. 

Finally, the gain matrix may be calculated by either the augmenta- 
tion of the C matrix or by using the pseudo-inverse of C. The detection 
filter for which simulation results are presented was designed using the 
augmentation approach. The ten degrees of freedom associated with the 
unde rde termination of the gain matrix were removed by eliminating the 
effect of one measurement on the filter . In order to determine which 
measurement to eliminate, detection filters were designed with each 
eliminating the effect of a different measurement. The normal accelera- 
tion measurement Wcus chosen for suppression because this maximized the 
signature plane separation . The normal acceleration measurement was 
still used in the calculation of the residual and therefore in detecting 
and isolating failures . However, the effect of the measurement on the 
filter was eliminated by forcing the corresponding column of the gain 
matrix to be zero. 

This design produced elevator and rudder failure signature planes 
that were orthogonal to each other and to all of the other failure 
planes. However, the separation between the failure planes corresponding 
to the ailerons and the flaps were much smaller. For the purpose of 
defining a measure of separation between these planes, the eleven- 
dimensional residual space may be reduced to a three-dimensional space, 
since all but three components of the vectors which define these planes 
are approximately zero. These three components are the normal accelera- 
tion, body axis roll rate, and altitude rate components, and thus these 
measurements will be most sensitive to these control surface failures. 

In a three-dimensional space, the angle between signature planes is a 
possible measure of separation and is the measure used here. The 
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separation between the failure planes for the two ailerons was about 
0,349 rad (20®); the separation between failure planes corresponding to 
the aileron and the flap on the same wing was about 0,5235 rad (30®), 
Given these results, it might be anticipated that this detection filter 
should be able to detect and isolate elevator and rudder failures and be 
able to detect but not isolate wing surface failures. 

The pseudo-inverse approach to calculating the detection filter 
gain matrix was also investigated. While the pseudo-inverse approach 
produced directions of the columns of C(B - KD) and D that were more 
separated than the augmentation approach, the failure signature planes 
were less distinct. Using the scaling presented in Table 3.1, the 
pseudo-inverse design resulted in identical failure planes for the two 
ailerons and about 0.349 rad (20®) separation between the failure planes 
corresponding to the aileron and the flap on the same wing. The failure 
plane segments for the two ailerons, while not overlapping as with other 
scalings tried with the pseudo-inverse approach, are adjacent to each 
other as shown in Figure 3,4, making isolation difficult. 

As the detection filter designed using the augmentation approach 
produced slightly better plane separation, this filter was chosen for 
testing. The test cases for which results are presented in this section 
are described in Table 3.2. The results presented are in terms of the 
residual projected onto the two plane segments for each surface which was 
defined earlier in this section. These results are shown in Figures 3,5 
through 3,13, In addition, the residual projection values were averaged 
from the time of failure until the end of the 40 s simulation run to 
approximately determine the size of the bias in the residual projection 
caused by the failure. These results are shown in Table 3,3. The 
residuals were low-pass filtered with a time constant of 1,0s to reduce 
the effects of noise and turbulence. 

Conclusions were made regarding the ability of the detection 
filter to detect and isolate failures using results from the nine test 
cases presented, FDI performance was assessed by comparing the magnitude 
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Figure 3.4. Failure plane segments for the left and i 
right aileron 



Table 3.2 

Test Cases for the Evaluation of the Unmodified Detection Filter 
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3.5 











Figure 3.6# Projection of the residual onto the failure signature 
plane segments, no failure case, severe turbulence 










Figure 3.7. Projection of the residual onto the failure signature 

plane segments, elevator failure, -0.0349 rad (-2®) bias 











Figure 3.8. Projection of the residual onto the failure signature 

plane seqments, elevator failure, -0.0349 rad (-2®) bias. 












Figure 3.9. Projection of the residual onto the failure signs 
plane segments, rudder failure, -0.0349 rad (-2®) 









Figure 3.10. Projection of the residual onto the failure signature plane 
segments, right aileron failure, -0.0349 rad (-2®) bias 












3»11» Projection of the residual onto the failure sig'nature 
plane segments, right flap failure, 10% bias 








Figure 3.12. Projection of the residual onto the failure signature plane 

segments, no failure case, off-nominal cruise flight condition 
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flight condition 







Table 3.3 

Mean Residual Projection Magnitudes for the 
Unmodified Detection Filter 
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Value not representative as the projection changes sign several times 



of the residual projections onto the planar segments as a result of the 
failures relative to the projections where a failure was not present* 

The following major conclusions were drawn. 

(1) The detection filter was able to detect and isolate at least 
moderate elevator and rudder failures in the presence of 
noise and minor turbulence (0.3 m/s or 1 ft/s). A 0.0349 rad 
(2®) elevator bias failure test case is shown in Figure 3.7, 
while the 0.0349 rad (2®) rudder bias failure case is shown 
in Figure 3.9. 

(2) The filter was able to detect but not isolate moderate wing 
surface (aileron and flap) failures in the presence of dis 
turbances. In the case of the right aileron failure shown 

in Figure 3.10, the detection filter correctly indicated that 
this surface had failed. However, the filter also indicated 
incorrectly that the failure might have occurred in the right 
flap or left aileron. A failure of the rudder has been elim- 
inated as a possibility since it causes only a slight change 
in the aileron and flap residual projections (Figure 3.9). 

In the case of the right flap failure shown in 
Figure 3.11, the filter correctly detected a right flap 
failure but it also suggested that a right aileron failure 
was possible. 

This difficulty in isolating wing surface failures is more a 
property of the system and the measurements chosen than the 
detection filter itself. The effect of the flaps and the 
ailerons were largely evident in the body axis roll rate and 
less evident in the normal acceleration, body axis yaw rate, 
and altitude rate measurements. However, the effects of the 
flaps and ailerons on the latter three measurements were not 
significant enough to be able to distinguish one aileron from 
the other or an aileron cind a flap on the same wing. 

(3) Based on the time of response for the decision function to 
reach a new steady state condition after a failure, the time 
to detect elevator and wing surface failures would be 
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approximately two seconds. The time required to detect a 
moderate rudder failure would be approximately five seconds. 
Detection times, in general, depend on the magnitude of the 
failure, the thresholds selected, the eigenvalue of the 
detection filter, and the time constant of the low-pass 
filter used to suppress noise in the residual. 

(4) Turbulence significantly degrades the performance of the 
detection filter. By comparing the no-failure cases shown in 
Figures 3.5 and 3.6, severe turbulence (1.98 m/s or 6.5 ft/s) 
can be seen to increase the likelihood of false alarms. In 
addition, severe turbulence significantly degrades the 
ability of the detection filter to even detect a moderate 
elevator failure. This can be seen by comparing Figures 3.7 
and 3.8. 

(5) Modeling errors also degrade detection filter performance. 

In order to test this detection filter - which was designed 
for a cruise flight condition at an altitude of 304.8 m 
(1,000 ft) and an airspeed of 77.2 m/s (150 knots) - with 
regard to modeling errors, test cases were generated for the 
aircraft in a cruise flight condition at an altitude of 
1524.0 m (5,000 ft) and an airspeed of 102.9 m/s (200 
knots). The no-failure case shown in Figure 3.12 reveals a 
bias in most of the decision functions. The major reason for 
this bias is a nonzero body axis roll rate residual caused by 
modeling errors. This bias is likely to increase the false 
alarm rate and to degrade the filter's ability to detect wing 
surface failures. The right aileron bias failure test case 
at the off-nominal cruise condition is shown in Figure 3.13. 
One method of reducing the sensitivity of the detection 
filter to modeling errors might be to estimate the bias 
caused by mismodeling and appropriately compensate the 
residual. 
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3.6 Conclusions 

The following general conclusions have been drawn from this phase 
of the study. 

(1) The detection filter can be used to detect control surface 
failures. 

(2) The detection filter can isolate failures of surfaces that 
produce independent effects on the aircraft but may not be 
able to isolate failures among surfaces that produce similar 
effects on the aircraft. The detection filter was unable to 
isolate wing surface (aileron and flap) failures. The main 
reason for this result is that these surfaces have similar 
effects on the aircraft dynamics. Isolation of failures will 
be difficult whenever there are functionally redundant 
control surfaces. If isolation of control surface failures 
is required for restructuring of the control system, 
additional software or hardware will be required. 

(3) The magnitude of the failures that can be detected depends on 
the sensor noise, disturbances, and modeling errors. The 
detection filter was especially sensitive to turbulence and 
modeling errors. Moderate (-0.0349 rad (-2®) elevator, 
aileron, rudder and 10% flap) failures could be detected in 
minor turbulence. However, detecting moderate failures in 
severe turbulence was much more difficult. While hardover 
failures were not tested, they should be easily detected even 
in severe turbulence. Modeling errors also degraded the 
ability of the detection filter to detect moderate failures. 
Detection of hard failure, though, should still be possible. 

(5) The failure detection and isolation times for the detection 
filter depend on the magnitude of the failure, the 
thresholds selected, the eigenvalue chosen for the detection 
filter, and the time constant of the low-pass filter, if any. 
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required to suppress noise in the residual. Approximately 
two seconds would be required to detect a moderate failure 
with the residual being low-pass filtered with a time 
constant of one second. Approximately five seconds would be 
required for a moderate rudder failure. Larger magnitude 
failures could be detected faster as much less, if any, 
filtering would be necessary. On the other hand, the 
detection and isolation of small magnitude failures would 
require heavy low-pass filtering for noise suppression which 
would impact the failure detection time because of the 
relatively long time required to reach steady state. 

(6) Detection filter theory is mature for restructurable controls 
application to linear, time-invariant systems with no input- 
to-output coupling. This is not the case for systems with 
input-to-output coupling for which actuator or control 
surface failure signatures become planar instead of uni- 
directional. Another effect of coupling is that scaling 

now impacts detection filter performance and there is no 
systematic method available to use it to improve perform- 
ance. In addition, no systematic method is available to use 
the degrees of freedom which exist by having more measure- 
ments than states. Finally, there is no theory for applying 
the detection filter to time-varying systems. 

(7) There is limited experience in applying the detection filter 
to systems. References 8 and 12 describe two of these appli- 
cations. 
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SECTION 4 


A MODIFICATION TO THE DETECTION FILTER FOR 
SYSTEMS WITH DIRECT INPUT- TO- OUTPUT COUPLING 


4.1 Introduction 

This section presents and evaluates a modification to the basic 
detection filter* The basis and need for the consideration of the 
modified detection filter arises from a limitation of the basic detection 
filter when it is applied to the aircraft restructurable control systems 
problem. Basic detection filter theory has been developed for systems 
for which no direct input-output (control surface deflection to 
measurement) coupling exists. In this case, the detection filter is 
designed so that an actuator or a control surface failure produces a 
unidirectional filter residual. This residual direction depends only on 
the component (actuator or control surface) that has failed and is 
independent of the mode of the failure (e.g., bias, ramp, etc.). 
Therefore, failures are detected and isolated simply by observing the 
magnitude and the direction of the residual. 

However, direct input-output coupling arises with regard to the 
restructurable controls problem because of acceleration measurements 
present on aircraft. As acceleration measurements are common onboard 
measurements and are, in general, of higher quality than angle of attack 
and sideslip angle measurements, detection filter design with direct 
input-to-output coupling was investigated instead of eliminating these 
measurements. The previous section on the detection filter showed that, 
with direct input-to-output coupling, the residual produced by an 
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actuator or control surface failure could be, at best, constrained to a 
plane using current detection filter design theory. Detection and isola- 
tion of failures with planer signatures is possible but more difficult. 

This section presents and evaluates a modification to the detec- 
tion filter to restore the unidirectional residual property produced by 
actuator or control surface failures when there is direct input-to-output 
coupling. The approach employed is to use secondary filtering of the 
detection filter residuals to produce unidirectional failure signatures. 
As before, the evaluation was conducted using the C-130 aircraft simula- 
tion, Failures were introduced into the simulation to assess the failure 
detection and identification capability of this modification. 

The modification is presented in Section 4.2, The results are 
presented in Section 4,3, and Section 4.4 contains the conclusions of 
this evaluation of the modification of the detection filter, 

4,2 Modification of the Detection Filter 

The effect of direct input-output coupling on actuator failure 
signatures for the detection filter, discussed in Section 3,2, forms the 
basis for the material in this section. Recall that without basic modi- 
fication of the detection filter, the effect of input-output coupling is 
to cause actuator failure signature to be planar instead of unidirection- 
al, In the course of applying the detection filter to the res true turable 
control problem, it was discovered that secondary filtering of t^e detec- 
tion filter residual could lead to unidirectional failure signatures even 
when there is direct coupling between inputs and measurements. Consider 
the discrete-time transfer function between the unexpected input from the 
ith actuator and the residual obtained by taking the z- transform of Bqs, 
(3.23) and (3,24), 


r(z) = [C(zl - A + KC)"\b^ - Kd^) + d^]n(z) (4.1) 

Assuming that the detection filter gain matrix, K, is calculated to 
satisfy the relationship 
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A - KC 


XI 


(4.2) 


where X is the selected detection filter eigenvalue, it follows that 

C(b. - Kd. ) 

r(z) = [ — + d. ] n(z) (4.3) 

Z “■ A 

If the contribution d^n(z) could be filtered with the same time constant 
as in the detection filter, the failure signature would be unidirec- 
tional, lying along C(b. - Kd. ) + d., 

-1 -X -1 

The secondary filtering scheme, then, has several elements. 

First, the components of the residual along the event vectors d^ are 
separated from the residual. Then they are filtered using the detection 
filter time constant. Finally, these filtered components are then added 
to the other components, forming a new residual. It is this new residual 
that is used for failure detection and isolation. 

In order for the initial separation of the components along d^ to 
be possible, all event vectors d^ must be mutually independent, and each 
must be independent of the hyperplane formed by the C(b^ - Kd^) vectors. 
To obtain the components of the residual in the directions d^, first 
write the residual 

r(k) - [C(b, - Kd,)^ I ... |c(b^ - Kd^)^ |S,h|32„|] 


= P£(k) (4.5) 

Here, C(b^ - Kd^) has been normalized for each of the six actuators of 


(k) 

C2(k) 


Cs(k) 


(4.4) 
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the present application, giving C(b. - Kd. ) , and d and d are the 

-X -X N -IN -2N 

distinct directions among the columns of the D matrix (two in this appli- 
cation), The vector £(k) is obtained using 


c(k) = P^r(k) 


(4.6) 


where P+ is the pseudoinverse (generalized inverse) [Reference 13] of 

P. 

The magnitudes c (k) and c (k) of the components of r(k) along d 
- / 8 -IN 

and d^j^ are passed through a secondary two-state filter; 


q' (k) 


Xlq’(k-I) + 


(k-1 ) 

Cs(k-I) 


(4.7) 


Substituting these filtered components for the unfiltered ones in c(k) 
leads to 


Cf (k) 


(k) 


Ce(k) 

q^' Oc) 

q'(k) 


(4.8) 


Transforming this vector of components back into the original residual 
space results in 


rf(k) = Pc^(k) 


(4e9) 
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Actuator failures may be detected and (simultaneously) isolated through 

projection of r (k) onto each of the six signature vectors C(b -Kd )+ d . 

-r _i _i _i 

In using the transformation p it has been assumed that £(k) lies 
in the eight~dimensional space spanned by columns of P» Applying trans- 
formations and P leads to suppression of noise in the residual that 
is in directions orthogonal to the range of p. Because noise in these 
directions only interferes with failure detection and isolation, this 
suppression could be very beneficial. 

The modified detection filter is shown in Figure 4.1. The 
operators S and R, where 


S = 


0 0 0 0 0 0 1 0 
0 0 0 0 0 0 0 1 


(4.10) 


and 


■ ^exe - 2727 - SesI 


(4.11 ) 


denote, respectively, the operations of forming the two-vector 
and of nulling out c^ and c^ in £. 


[c. 




T 


4.3 Modified Detection Filter Design 

A number of modified detection filter designs were tested via 
simulation to evaluate the concept. As with the unmodified detection 
filter, all the designs assumed a nominal cruise condition of 77.2 m/sec 
(150 knots) at an altitude of 304.8 m (1000 ft). The modified detection 
filters were designed using the same approach as for the unmodified 
detection filter because the modification consists simply of augmenting 
the detection filter with secondary filtering of the residual. As the 
secondary filtering is determined entirely by the linear model of the 
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Figure 4.1. Block diagram of the modified detection filter 














system, the gain matrix, and the detection filter eigenvalue, no design 
of the secondary filtering is required. Detection filter design, as 
presented in Section 3.3, consists of three steps: 

(1) measurement scaling selection 

(2) eigenvalue selection 

(3) gain matrix calculation. 

The selections which produced the best design are now described. 

The measurements were scaled to have the units shown in Table 
4.1. Note that these units differ from those selected for the unmodi- 
fied detection filter in Table 3.1. The measurement units chosen reduce 
the dominance of the acceleration measurements, which are highly affected 
by turbulence, in detecting and isolating failures while increasing the 
contribution of the higher quality angular velocity cind attitude measure- 
ments. Also, the airspeed residual was scaled to reduce the effect of 
the noisy airspeed sensor on the filter. 

Scaling the lateral acceleration measurement also reduced some 
numerical errors produced by the secondary filtering. The idea of secon- 
dary filtering is to filter the portion of the residual produced by 
direct input-to-output coupling with the same time constant as the detec- 
tion filter. Separating this portion of the residual from the total 
residual is not numerically exact. Therefore, a portion of the residual 
not associated with direct input- to- output coupling will be also fil- 
tered, producing small yet significant errors. (In addition, errors 
occur when some of the direct input- to- output contribution to the resid- 
ual is not passed through the secondary filter. However, these errors 
are too small to have a significant effect. ) 

The eigenvalue chosen was the same one chosen for the unmodified 
detection filter, in discrete-time the eigenvalue chosen was 0.95. For 
the sample time of 20 ms used in the simulation, the equivalent 
continuous-time eigenvalue is -2.6. 
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Table 4 . 1 

Measurement Units for Modified Detection Filter Evaluation 


MEASUREMENT 

UNITS 

Airspeed 

7*6 m/s 

25 ft/s 

Lateral Acceleration 

^ ^ / 2 
0*6 m/s 

2 ft/s^ 

Normal Acceleration 

1.5 m/s 

5 ft/s^ 

Angular Velocity 

•0056 rad/s 

•318 deg/s 

Attitude 

.0175 rad 

deg 

Altitude Rate 

0.3 m/s 

ft/s 

Altitude 

0.3 m 

ft 








The gain matrix was also calculated using the same method used in 
producing the best design for the unmodified detection filter: the 
augmentation of the C matrix approach. As before, the effect of the 
normal acceleration measurement on the filter was suppressed by forcing 
the corresponding column of the gain matrix to be zero. The normal 
acceleration measurement was still used in the calculation of the resid- 
ual and therefore in detecting and isolating failures. 

4.4 Modified Detection Filter Results 

The test cases used to evaluate the modified detection filter are 
described in Table 4.2. These cases included the no-failure simulation 
(Figure 4.2) and simulations of failures of elevator, right aileron, left 
aileron, right flap, cuid rudder (Figures 4.3 through 4.7) in the presence 
of low-level turbulence. To determine the effects of higher turbulence 
intensity, data for the no-failure case and the -0.0349 rad (2**) elevator 
bias failure case with a turbulence level of 0.3 m/s (6.5 ft/s) rather 
than the nominal 0.3 m/s (1 ft/s) were also processed. These results are 
shown in Figures 4.8 and 4.9, respectively. The cases described above 
assumed the aircraft to be at the nominal cruise condition of 77.2 m/s 
(150 knots) at an altitude of 304.8 m (1000 ft). The effect of modeling 
errors was determined by processing data for the no-failure and right 
aileron failure cases (Figures 4.10 and 4.11, respectively) at an 
off-nominal cruise condition using the filter designed for the nominal 
cruise flight condition. All failure onsets occurred at five seconds, 
and sensor noise was also simulated. The residuals were not low-pass 
filtered as they were for the unmodified detection filter, however. 

Figure 4.2 shows the projection of the residual vector r^ onto 
each of the unitized failure signature directions for the no-failure 
case. Only the system noise and the unmodeled dynamics influence the 
residual after the filter transients die away. Turbulence affects the 
modified detection filter residual projections more than those of the 
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Figure 4.2. Projection of the residual onto the normalized expected failure 
signature directions - no failure case 
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Figure 4.3. Projection of the residual onto the normalized expected failure 
signature directions - elevator failure (2^ bias) 
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Figure 4.4. Projection of the residual onto the normalized expected failure 
signature directions, right aileron failure, -0.0349 rad (-2°) bias 
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Figure 4.6. Projection of the residual onto the normalized expected failure 
signature directions, right flap failures, 10% bias 
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Figure 4.7. Projection of the residual onto the normalized expected failure 
^signature directions, rudder failure, -0.9349 rad (-2°) bias 
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Figure 4.9. Projection of the residual onto the normalized expected failure 
signature directions, elevator failure, -0.0349 rad (-2°) bias. 
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Figure 4.10. Projection of the residual onto the normalized expected failure 
signature directions, no failure case, off-nominal flight condition 
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Figure 4.11. Projection of the residual onto the normalized expected failure 
signature directions, right aileron failure, -0.0349 rad (-2^) 
bias, off-nominal flight condition 








unmodified filter because the modified filter relies more on the normal 
acceleration measurement to detect elevator, aileron, and flap failures. 
This is true despite the attempt to diminish the use of the normal 
acceleration measurement and rely more on the roll rate measurement 
through scaling of the measurements. 

The residual projections become biased relative to the no-failure 
residual projections about a second after the failure. The bias appears 
to be approximately constant, which is a reflection of the unidirection- 
ality of the failure signatures. In order to determine the size of the 
bias, the residual projection values were averaged from the time of 
failure until the end of 40 s simulation run. The results for the test 
cases are shown in Table 4.3. With suitable thresholds for decision, it 
is reasonable to expect that, for the case where the filter has a good 
model, residual projection magnitude could be used to detect any of these 
control surface failures at low turbulence levels. By comparing the mean 
residual projections onto the expected failure directions, elevator and 
rudder failures are clearly identified. Not unexpectedly, however, 
isolating specific wing surface failures was more difficult. For both 
aileron failure cases, the modified detection filter was able to isolate 
the failure to the aileron or flap on the correct wing. This conclusion 
was based on the mean residual projections for the aileron and flap on 
the correct wing being larger than the other mean residual projections. 
Based on the one flap failure case, isolating the failure to one of the 
flaps might be possible. While unable to clearly isolate wing surface 
failures, the modified detection filter was better able to distinguish 
between the wing surfaces than the unmodified detection filter. 

High-level turbulence significantly affects the filter residual 
and therefore the residual projections. If thresholds were set to detect 
failures with low-level turbulence, the high-level turbulence would 
probably cause a failure to be indicated even in the no-failure case. 

Yet, when compared to the high-turbulence no-failure case, the elevator 
failure in high turbulence still has a detectable signature, although 
a flap failure is also falsely indicational. 
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when the filter model was less representative of the actual dynam- 
ics, the effect of the mismodeling was to introduce a large bias in the 
filter residual. This led to large residual projections, an indication 
of failure — even in the no- failure case. But the residual was notice- 
ably larger in the aileron failure case (the only failure tested at the 
off-nominal cruise condition), and the projections were offset from those 
of the no-failure case by approximately the same amounts as for the 
corresponding cases tested at the nominal cruise condition. 

In order to reduce the sensitivity of the modified detection 
filter to both turbulence and modeling errors, dynamic thresholds or a 
method of estimating the residual biases caused by disturbances and 
modeling errors would be of benefit. If estimating these biases were 
possible, the residual could be appropriately compensated and failures 
could still be detected and isolated. 

4.5 Conclusions 

The modified detection filter has been presented and it has been 
evaluated with regard to its ability to detect and isolate aircraft 
control surface failures. The following conclusions and advantages and 
disadvantages of the modification to the detection filter are based on 
the results described in the last section. Comparisons with the 
unmodified detection filter are also presented where appropriate. 

(1) The modified detection filter can be used to give unidirec- 
tional failure signatures in applications where there is 
direct coupling of inputs to measurements. The modifications 
required are minor. Unlike the unmodified detection filter 
for this application, there are straightforward detection and 
isolation tests based directly on mean residual projection 
magnitude and direction. 

(2) Noise orthogonal to the C(b. - Kd. ) and d. directions is 

-X -1 -1 

suppressed as a by-product of the secondary filtering. 
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(3) 


Small but significant residual errors can be caused by the 
secondary filtering because separating the portion of the 
residual produced by direct input-output coupling is not 
numerically exact. 

(4) The modified detection filter can be used to detect control 
surface failures in low level turbulence with no modeling 
errors. 

(5) The modified detection filter will have difficulty in isolat- 
ing failures that produce similar effects on the aircraft. 
Both the unmodified and modified detection filters were not 
able to isolate wing surface (aileron and flap) failures to a 
specific wing surface. However, the modified detection 
filter shows more promise of being able to distinguish 
between these surfaces which produce similar effects. 

(6) The modified detection filter is sensitive to disturbances 
such as turbulence and to modeling errors. Dynamic 
thresholds or some method of estimating the no-failure 
residual magnitudes could be of benefit in achieving adequate 
levels of FDI performance. If this is possible, detecting 
failures with turbulence and modeling errors would still be 
achieved. 

(7) Based upon the time for the projection of the residual onto 
the failure signature directions to significantly show the 
effects of a failure, the failure detection and isolation 
times for the modified detection filter in low turbulence 
were on the order of a second, approximately the same as 
those obtained for the unmodified filter. 

(8) As the modification is a new concept, it is not mature in 
either theory or application. 
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(9) Given our experience with both the unmodified and the 
modified detection filter, it is our judgment that the 
modified detection filter holds more promise for applications 
with direct input- to-output coupling and therefore deserves 
continued investigation • 
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SECTION 5 


LIKELIHOOD RATIO TESTS 


5.1 Introduction 

Likelihood Ratio Tests are evaluated in this section with regard 
to their ability to detect and isolate control system failures* Two 
tests are evaluated: the Generalized Likelihood Ratio Test and the 

Orthogonal Series Generalized Likelihood Ratio Test* An analytical 
development of each algorithm is presented. Simulation results, which 
directly compare the FDI capability of both algorithms, are shown and 
discussed* Most of the material contained in this section is taken from 
Reference 10* 

5*2 The GLR Test for Dynamic Systems 

The details of the GLR test may be found in Reference 9* A 
discrete— time system is assumed for the present discussion* In the 
normal mode of operation the state dynamics and measurement 

equation are given by 

x(k+1) = ${k)x(k) + B(k)u(k) + w(k) + g(k) (5.1) 

y(k) = C(k)x(k) + D(k)u(k) + v(k) + h(k) (5.2) 

£(k) and h(k) are bias vectors* w(k) and v(k) are independent, 
zero-mean, white Gaussian sequences with covariances given by 
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QOt) fi... 

'•J 


(5.3) 



E[v(k)V*^( j)] = R(k)fi|^j (5.4) 

The GLR failure hypothesis is that 

x(k+1) = *(k)x(k) + B(k)u(k) + w(k) + £(k) + b(k)n(k,9)v (5.5) 

XOc) = C(k)x(k) + D(k)u(k) + v(k) + h(k) +d(k)n(k,6)v (5.6) 


where Mk) and ^(k) are known vectors that depend on the type of the 
failure. For example, if an actuator failure is modeled, ^(k) will be 
the column of the matrix B(k) corresponding to that actuator, and d(k) 
will be the corresponding column of D(k). If a sensor failure is model- 
ed, Mk) will be the zero vector, and ^(k) will be given by 

di(k) = 6^^, i = 1, 2, ..., m (5.7) 

where j is the index corresponding to the failed sensor. n(k, 0) is the 
mode shape, or simply mode , of the failure, which occurs at time 0. 
Generally, we have that 

n(k,0) =0, k < 0 (5.8) 

For example, if a bias failure is assumed, then 

0 k < 0 

n(k, 0) = (5.9) 

1 k _> 0 

Finally, v is the magnitude of the failure. 
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For the analysis that follows, the deterministic input and bias 
terms in the state and measurement equations that are common to both 
hypotheses may be eliminated, due to the linearity of the equations# 
Therefore, the no-failure hypothesis (H^) and the failure hypothesis 
(H^) are represented by 


x(k+l ) 

= $(k)3c(k) 

+ w(k) 


(5.10) 

y(k) 

= C(k)3c(k) 

+ v(k) 


(5.11) 

x(k+1 ) 

= $(k)3c(k) 

+ w(k) 

+ Mk)n(k, 0) V 

(5.12) 

y(k) 

= C(k)x(k) 

+ v(k) 

+ ^(k)n(k, 9) V 

(5.13) 


Suppose the data ^0?^) are observed over the observation interval 


k 


0 


k ^ kf 


(5.14) 


For a given time of failure, 0, and magnitude of failure, v, the 
Likelihood Ratio (LR) is given by 

(5.15) 

Because the ^(k) are not independent from time step to time step, the 
evaluation of the conditional probabilities is difficult. To evaluate 
the LR, a Kalman filter is implemented, based on the normal mode (Hq) 
system. The filter equations are 


y(k +1), ..., y(k ) H. ,0,v) 
Afk ft vl =: z. ^ * 


x“(k+1) = $(k)x'*'(k) 


(5.16) 
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(5.17) 


3Cj*'(k) = 3c^(k) + K(k)j[(k) 

where K(k) is the Kalman gain matrix, and ^(k) is the residual, given by 

_Y(k) = y(k) - C(k)^"(k) (5.18) 

The Kalman gain matrix is given by 

K(k) = p"(k)c’’(k)M~^ (k) (5.19) 

where P*"(k) is the covariance of the estimation error 

(5.20) 

and M(k) is the covariance of J[(k), given by 

M(k) = C(k)p"(k)c'^(k) + R(k) (5.21) 

The covariance is propagated by 

p"(k+1) = $(k)p'^(k)$'^(k) + Q(k) (5.22) 

P'^(k) = [I - K(k)C(k)]p“(k) (5.23) 

The LR may then be written in terms of the residual sequence j^(k) rather 
than the measurement sequence. Because the residual sequence is (condi- 
tionally) a white Gaussian sequence, the LR is easier to determine in 
terms of J£(k) than in terms of _y(k). 

Due to the linearity of the state equation and the filter equa- 
tions, the residual may be expressed under each hypothesis as 
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Hq: yOc) 

= YqOO 

(5.24) 


= Yq(Jc) + £(k, 0) V 

(5.25) 


where J[qO^) is a zero-mean, white Gaussian sequence with covariance 
M(k). ^(k, 0) is the failure signature of a failure occurring at time 0. 

£(k, 0) is given by 


g(k, 0) = c(k)£(k,0) + d(k)n(k, 0) (5.26) 

where ^(k, 0) is the influence of the failure mode n(k, 0) on the state 
estimation error. _f (k, 0) may be generated recursively by 

£(k+1,0) = $(k)[I - K(k)C(k)]f^(k, 0) + [b(k) - $(k)K(k)d(k) ]n(k, 0) 

(5.27) 


with the initial condition 


f.(k^,0) = 0 _ 


(5.28) 


It can be seen therefore that 


f(k, 0) =0, k < 0 


(5.29) 


The IjR is given by 


p(j(ko), l{J«Q+1)f •••» H^»0/V) 

A(kf ' ' p(j(kQ), i(kQ+1), ..., Y(k^)|H^) 


(5.30) 


Because the resi(3ual sequence is (conditionally) Gaussian and white, the 
Log Likelihood Ratio (LLR) ratio has a particularly simple form: 
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(5.31 ) 


where 


0, v) 


V x(5tf»9) - v^S(k^,0) 


X(kf,6) 


^ £^(k,0)M \k)j(k) 
k=9 


S(k^,9) 


f £’’(k,9)M~^ (k)£(k) 
k=9 


Now, the generalized likelihood ratio is given by 


£(k ) = max £(k , 9, v) 

A A ^ 

9, V 

Performing the maximization over v first, we have that 


- X(kff9) 


Hence, the GLR test statistic is given by 


A(k ) = max — 

^ A ^ 


1 X^(kffQ) 


9 S(k^,9) 


As a matter of convenience, the GLR decision function is 


X^(k , 9) 

DF(k^) = 2 f(k^) = max 

0 S(k^,9) 


A failure is detected when the decision function exceeds 
threshold. 


(5.32) 


(5.33) 


(5.34) 


(5.35) 


(5.36) 


defined by 


(5.37) 


the detection 
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A closed-form solution to the above maximization does not exist 
in general. Therefore, in order to implement the GLR, the statistic 
must be computed for all possible times of failure, 0. As a 
result, a bank of matched filters that grows linearly with time is 
required. To avoid this unlimited growth in the amount of computation, 
the assumed time of failure may be restricted, say, to be in the range 
kf - N < 0 ^ kf . Even so, the amount of computation required to 
implement the GLR can be quite large, especially if N is large. 

5.3 The Orthogonal Series GLR Test 

The Generalized Likelihood Ratio methods of FDI tend to be 
computationally burdensome. This complexity arises from the need to 
estimate the randc^n onset time of the failure, which generally requires 
a nonlinear estimation structure. In addition, these methods may not be 
robust to failure mode uncertainty. 

An FDI algorithm that is robust to failure mode uncertainty is 
the detection filter. Unfortunately, the applicability of the detection 
filter is limited by a number of factors. One restriction is that the 
theory is limited to linear time-invariant systems. Also, the detection 
filter design process breaks down for systems where two or more failure 
types are not "output separable," even though it should be possible to 
detect and isolate failures for some such systems. Finally, little 
guidance exists on how to choose the free parameters in the design 
process, such as the filter eigenvalues. 

In this section, an algorithm that addresses these problems, the 
Orthogonal Series Generalized Likelihood Ratio (OSGLR) Test, is 
proposed. As suggested by its name, the OSGLR test is indeed a GLR 
test. The hypothesis upon which the test is based is that the failure 
modes can be represented as truncated orthogonal series of time 
functions. Because such a series can represent a broad class of failure 
modes, the test should be robust to failure mode uncertainty. The test 
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is not as computationally complex as other GLR methods, because the time 
of failure does not enter the failure hypothesis explicitly. The only 
unknowns in the failure hypothesis are the coefficients of the terms in 
the orthogonal series. Because they enter the state and measurement 
equations linearly, these unknowns can be estimated by relatively simple 
linear schemes. In practice, the discrete-time case is likely to be 
more useful, because it is more eimenable to computer implementation. 
However, continuous- time systems will be dealt with here because the 
mathematics are less cumbersome. 

5*3.1 OSGLR Hypotheses 

We are interested in detecting failures in linear dynamic systems, 
which \inder normal conditions are modeled by 

d 3 c(t) = A(t) 3 c(t) + B(t)^(t) + w(t) (5.38) 

dt 

y(t) = C{t)x(t) + D(t)u(t) + v(t) (5.39) 

^(t) and Wt) are independent, zero-mean, Gaussian processes with 
autocorrelation functions given by 

E[w(t^ )w'^(t 2 )] = Q(t^ ) 6 (t^-t 2 > (5.40) 

E[v(t^ )v^(t 2 )] = R(t^ ) 6 (t^-t 2 ) (5.41) 

When a failure occurs, either the state dynamics change or the 
measurement equation changes. For example, if the ith actuator fails, 
the actual input vector, ^(t), differs from the commanded input, \i(t), 
as follows: 


u (t) 
— a 


u(t) + 




(5.42) 
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where is a q-dimensional unit vector in the ith coordinate direc- 
tion, i.e*, the elements of e^^ are given by 

(e^^)j = ^i j ^ ^ •••f ^ (5*43) 

where 6j^j is the Kronecker delta, f(t) is the mode shape of the fail- 
ure, For example, if the failure is a bias shift, then f(t) is a step 
function of some magnitude at the time of the failure* Thus, the state 
dynamics and measurement equations become 

dJcCt) = A(t)3c(t) + B(t)\i(t) + ^(t)f(t) + w(t) (5*44) 

“dt 

y(t) = C(t)x(t) + D(t)u(t) + ^(t)f(t) + v(t) (5.45) 

where ^(t) and ^(t) are the ith columns of B(t) and D(t), respec- 
tively* 

Similarly, a failure in the ith sensor can generally be repre- 
sented in the measurement equation as 

y(t) = C(t)x(t) + D(t)u(t) + e .(t)f(t) + v(t) (5,46) 

— — — — mi — 

As in the case of an actuator failure, f(t) depends on the mode of the 
failure* For example, if the output of the ith sensor is fixed at zero 
(except for the additive noise), then 

f(t) = - c^(t)x(t) - d^(t)u(t) (5.47) 

T 

where c^(t) is the ith row of C(t)* The situation is more complicated 
for changes in the plant dynamics. Reference 10 should be consulted in 
this regard* 
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For most types of failures (actuator failures, sensor failures, 
and some types of dynamics changes), the effect of the failure can be 
captured in the state and measurement equations as 

A(t)x(t) + B(t)u(t) +b(t)f(t) +w(t) (5.48) 

C(t)x(t) + D(t)u(t) + d^(t)f(t) + v(t) (5.49) 

The vectors ^(t) and ^(t) are known ahead of time for each type of fail- 
ure, whereas the mode of the failure, f(t), is generally unknown^ 
priori . In the analysis that follows, the terms due to the input _u(t) in 
the state and measurement equations can be neglected, due to the linear- 
ity of the equations and the fact that B(t), D(t), and n(t) are known. 

It is important to remember, however, that these terms must be included 
in any implementation of the OSGLR algorithm. Specifically, these terms 
must be included in the Kalman filter that estimates jc(t). The 
discussion will be confined to the binary hypothesis testing case. That 

is, we will assume that we are only trying to detect a single failure 

type, rather them detect and isolate from a set of failure types. Later, 
the results will be extended to include the isolation problem. 

The OSGLR test will be derived in the following manner. The 
fixed-length data test for data observed over the interval 

will be found. This fixed data test will then be suitably modified to 
form a sequential test. The no-failure (Hq) and failure (H^ ) 
hypotheses are given by 


dx{t) 


dt 

= A(t)2c(t) 

+ w(t) 

(5.50) 

y(t) 

= C(t)x(t) 

+ v(t) 

(5.51) 


dx(t) 

dt 

y(t) = 
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(5.52) 


dx(t) 

— = A(t)3c(t) + w(t) + b(t)f (t) 

y(t) = C(t)x(t) + v(t) + d(t)f(t) (5.53) 

For both hypotheses ^(t^) is a Gaussian random variable with zero mean 

and covariance P^. 

0 

Because the failure mode shape f(t) has not been specified, the 
hypothesis H-j is not complete. In order that the test be robust to 
failure mode uncertainty, it would be desirable to allow f(t) to be 
completely arbitrary. However, this assumption does not lead to a 
well-posed problem. Therefore, some further assumptions must be made. 

The approach that will be taken here is to represent the mode 
shape f(t) by a truncated series expansion with unknown coefficients. 

The motivation is that if the basis functions of the expansion are chosen 
properly, it should be possible to approximately represent a rich class 
of failure modes. Therefore, it is assumed that f(t) can be expressed as 


P 

f(t) = I (5.54) 

i=1 

where p is the number of basis functions, the a-jj_ are unknown coeffi- 
cients, and the <t>ii(t) are the basis functions. Bq. (5-54) can be 
expressed more conveniently in vector form as 

f(t) = i^tt)a^ (5.55) 

The subscript "1" indicates that this is an intermediate representation. 
Ultimately, we will be interested in a representation of the form 
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f(t) 


(5.56) 


= t)£(t^) 

It cannot be overemphasized that the representation of f(t) in Eq. (5.55) 
is meant to be an approximation. There is no reason to believe that an 
actual failure mode will have this particular form. 

Two important features of these hypotheses are that the failure 
hypothesis does not include a parameter representing the time of failure, 
and that the unknown parameters enter into the problem linearly. Hence, 
nonlinear estimation will not be required. As will be seen, this signi- 
ficantly reduces the amount of computation required relative to other GLR 
methods . 


5.3.2 Derivation of the OSGLR Algorithm 

The OSGLR test is derived in several steps. First, the test is 
derived based on the representation of f(t) given by Bq. (5.55). Next, 
the test is converted to a form that corresponds to a second intermediate 
representation of f(t). A special case of this representation is given 
in Eq. (5.56). In the process, the test statistic is converted from an 
integral representation to a differential equation representation. A 
more complete derivation may be found in Reference 10. 

To determine the form of the test, we proceed as follows. A Kal- 
man filter based on the unfailed system statistics (Hq), is used to 
generate the residual process j[(t). The filter equations are 


d^(t) 

— r- — = A(t)x(t) + K(t)y(t) 


_X(t) = ^(t) - C(t)x(t) 


(5.57) 

(5.58) 

(5.59) 


84 


dp(t) 

dt 


K(t) = P(t)c'^(t)R"'' (t) 


(5.60) 


A(t)P(t) + P(t)A’’(t) + Q(t) - P(t)c'^(t)R“\t)C(t)P(t) 


(5.61) 


= ^0 


(5.62) 


where x(t) is the estimate of x(t) , P(t) is the covariance of the estima- 
tion error, and K(t) is the Kalman gain matrix. The process j^(t) con- 
tains exactly the same information as ^(t), because each can be deter- 
mined unambiguously from the other. However, ^(t) is easier to work with 
than Wt) because it is a white noise process, whereas yit) is correlated 
in time* 

By the linearity of the Kalman filter and the system equations, 
the residual can be decomposed as 

l(t) = Y^(t) + (t) (5.63) 

where jQ(t) is the residual process that results under H^, and (t) is 
the part of the residual due to the failure. Again, due to the linearity 
of the filter and the system, (t) can be expressed as 

Y^(t) = G^(t)a^ (5.64) 

where the matrix (t) represents the influence of the vector of coef- 
ficients a^^ on the residuals, and remains to be determined. Therefore, 
we can rewrite the two hypotheses as 



Y(t) = » ^0 - ^ (5.66) 

where is a zero-mean, Gaussian process with the autocorrelation 

function 


“ R(t^ )6(t^-t2) (5.67) 

Hence, the problem of deciding between and has been reduced to the 

problem of deciding whether or not a bias signal is present in the white 

residual process* 

It can be shown that the information vector, defined by 

y T -1 

Ji^(t^) = / G^(t)R (t)j(t)dt (5.68) 

S 

is a sufficient statistic, i*e*, that it contains all the information 
contained in the residual process regarding the hypotheses* Hence, it 
can be used in place of the entire time history of the residuals to 
determine whether a failure has (x:curred* Now, is a Gaussian 

random vector, because y(t) is a Gaussian random process* Hence, its 
probability density is completely specified by its mean and covariance* 
Under H^, the mean of is zero since the residual has a mean value 

of zero* The covariance of ^nown as the information matrix, is 

given by 

S^(t^) = / Gj^(t)R"'' (t)G^ (t)dt (5.69) 

^0 

Under , j^^(t^) has the same covariance, but its mean is given by 
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(5.70) 


s[Xi(tf)|Hj = S^(t^)a^ 

The two hypotheses can be rewritten as 

Hq' ~N(£,S^(t^)) (5.71) 

~ N(S^ (t^)a^ ,S^ (t^)) (5.72) 

The problem of deciding between and has now been reduced to the 
problem of deciding whether the Gaussian random vector ^ zero 

mean or nonzero mean. Because the hypothesis is composite, an 
appropriate test to use is the GLR test. 

The GLR decision function is defined by 

DF(t^) = J$J^(t^)s”\t^)_X^(t^) (5.73) 

Reference 10 contains a derivaton of the GLR test statistic. Then the 
GLR test is given by 


decide 

DF(t^) I (5.74) 

decide 

0 

The threshold is written as T^ because the decision function is a posi- 
tive definite form. Therefore, a negative threshold would yield a trivi- 
al test that always decides that H-| is true. Also, writing the thresh- 
old as T^ rather than T will simplify the results of later sections. 

To complete the derivation of the test, we must determine G^(t). 

It can be shown (Reference 10) that G^ (t) is given by 
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G^(t) = C(t)P^ (t) + d(t)_^J‘(t) (5.75) 

where 

[A(t) - K(t)C(t)]F^ (t) + [b(t) - K(t)d(t)]j.^(t) 

(5.76) 

F^(t^) = 0 (5.77) 

The above equations specify the OSGLR test for the failure as 
represented by Eq# (5«55)« However, this representation has two weak- 
nesses. First, because the basis functions 6 . (t) were chosen 
arbitrarily, they may be highly correlated. The second problem is that 
the basis functions are defined relative to an absolute time scale, 
rather than with respect to the terminal time, tf. For a number of 
reasons, it is desirable to define the basis functions relative to the 
time tf, in which case the basis functions are <|)^{t^-t) rather than 
(|)li(t). For one thing, if the transformed basis functions are functions 
of tf-t, then they will have the same shape on the time scale defined 
relative to the end of the observation interval, t^. Also, if the 
system is time-invariant, the OSGLR equations will then be time-invariant 
in steady state. 

Both of these problems can be remedied in the following way: A 

new set of basis functions will be defined that is the original set of 
basis functions orthogonalized over the interval [tQ,tf ] . This will 
eliminate the first of the problems discussed above. The second problem 
may be solved by judicious choice of the original set of basis 
functions. The vector of basis functions (t) is transformed by 
an invertible linear transformation F(t^), so that 


dF^ (t) 
“dt 

and 
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r(t^)_i^ (t) 


(5.78) 


The transformation r(tf) is intended to orthogonalize the vector of 
basis function over the interval [tQ,tf], although it is not 

necessary that it do so. Based on this new vector of basis functions, a 
new information vector ^(t^)» information matrix S(t^), and influence 
matrices G(t^) and P(t^) can be developed. These quantities are related 
to j^^(t^), S^(t^), G^(t^), and by the matrix r(t^). With the 

help of these relationships, differential equations for these new 
quantities cam be derived. A useful definition is the following: 


1 T 

-dS— 


(5.79) 


The equations for the OSGLR algorithm then become 




+ G’’(t^)R"^ 


(5.80) 


with initial condition 




d 

dt. 


S(t^) 


- A^(t-)S(t.) - S(t-)A (t.) 
a r f fat 

+ G'^(t^)R‘‘' (t^)G(tj) 


with initial condition 


(5.81 ) 


(5.82) 


S(tQ) = 0 


(5.83) 
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(5.84) 


G(t^) = 



F(t^) 


[A(t^) - K(t^)C(t^)]P(t^) 

+ Cb(tj) - K(t^)d(t^)]^2(tf,t^) - F(t^)A^(t^) (5.85) 


with initial condition 


F(t^) - 0 (5*86) 

Now suppose that the basis functions are required to be shift 
invariant so that 




(5.87) 


Note that with the basis functions in this form, the failure mode f(t) 
has the form described in Bq. (5.56). It can be shown that the vector of 
basis functions t) satisfies the differential equation 



(5.88) 


where A is a constant matrix, 
9 


and T is a dummy variable defined by 


T = - t 


A is related to A (t^) by the equation 
q> a f 


A^ = -A 
(j> a 


(5.89) 


(5.90) 
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That is f is also a constant, x may be thought of as defining a 
relative time scale that runs backward from the end of the observation 
interval, t^. In some ways, the relative time x is more natural for 
the failure detection problem than the absolute time t because it 
represents time relative to the current time (tf), rather than relative 
to some arbitrary fixed initial time. 

Note that the basis functions affect the OSGLR equations only 
through and Therefore, if required to be 

shift-invariant, the OSGLR equations will be functions only of the system 
matrices, A^, and _^(0). In other words, there is no need to specify the 
underlying basis functions or the transformation F(t^). Since 

there is little motivation for using a basis which is not shift- 
invariant, this will be assumed to be true. 

The OSGLR equations for continuous-time systems are summarized in 
Table 5.1. 

After a failure has been detected, action must be taken by the FDI 
system to accommodate for the failure. Accommodation involves two 
distinct actions. First, the failed component, which is usually a sensor 
or an actuator, must be physically isolated from the system so that it 
can do no more harm. This aspect of accommodation is problem specific, 
and will not be discussed further here. 

The other action the FDI system must take is to prepare to contin- 
ue performing failure detection. A number of bookkeeping operations must 
be performed, such as changing the system models to account for the loss 
of the failed component, and reinitializing the information vector and 
information matrix to zero for each of the remaining components. The 
Kalman filter must be updated to account for the failure, so that 
monitoring of the other components can continue. More specifically, the 
filter estimate and covariance should be updated as follows: 

x(t+) = x(t-) + F(t)a(t) (5.91) 
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Table 5-1 • Summary of continuous-time OSGLR equations 


Estimation 

error influence matrix propagation: 

dP(t) 

dt 

= [A(t) - K(t)C(t)]F(t) + [b(t) - K(t)d(t)] ({.“^(O) + F(t)A'^ 

— — (() 

p(to> 

= 0 

Residual influence matrix: 

G(t) = 

C(t)F(t) + d(t) (|)^{0) 

Information 

vector propagation: 


= A^(t) + G’^(t)R"^t)Y(t) 

dt 


= 2 

Information 

matrix propagation: 

dS(t) 

dt 

= A^S(t) + S(t)A'^ + G'^(t)R”\t)G(t) 
<P <P 

S(t^) 

= 0 

Decision Function: 

DF(t) 
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(5.92) 


P(t''’) = P(t“) + F(t)P (t)F^(t) 

cl 

where t and are the times just prior to t and just after t, respec- 
tively. 


5.3.3 QSGLR Performance Analysis 

The performance of a failure detection and isolation (FDI) test 
depends on three types of events; false alarms, the detection of fail- 
ures, and the (correct or incorrect) isolation of failures. A complete 
probabilistic description of these events, together with the distribution 
of failures, is required in general to determine the performance of a 
fault- tolerant system. 

Unfortunately, it is generally quite difficult to evaluate the 
performance of cm FDI test smalytically. In principle, the performance 
of an FDI test could be determined by Monte Carlo simulation. However, 
the probability of false alarm, missed detection, or incorrect isolation 
is very small for an effective FDI test. The amount of simulation re- 
quired to estimate these probabilities accurately by Monte Carlo methods 
is therefore prohibitive. 

In Reference 10, a partial solution to the problem of evaluating 
the performance of the OSGLR test is given. The false-alarm performance 
of the OSGLR test is considered and an asymptotic expression for the 
steady-state false-alarm rate of the continuous-time OSGLR test is 
derived. Based on this analysis, an asymptotic bound is derived for the 
steady-state false-alarm rate of the discrete-time OSGLR test, and the 
conditions under which this bound is valid are discussed. 

The derivation of the aforementioned performance criteria for the 
OSGLR algorithm are cjuite lengthy and complex. Therefore, only the 
resultant expressions obtained are presented here. For the continuous 
time case the false alarm rate, as a function of the threshold T, is 
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X 


00 


(5.93) 


-tr[A^]T 

r« + 1 


{1 



where r is the gamma function. 

The bound for the discrete time case is 


-£n (det 

At r(|- + 1 ) 2 ^/^ 


-T"/2 



00 


(5.94) 


The conditions under which this bound is valid are discused in 
Reference 10. 

The asymptotic results obtained have been compared to exact 
results obtained numerically. As a practical matter, numerical results 
can be obtained only for the scalar case (p=1). Figure 5.1 shows the 
relative error in these approximations as a function of the threshold, 

T. (The relative error is defined by the error in the approximation 
divided by the actual value of the eigenvalue.) As might be expected, 
the two-term approximation is significantly better than the one-term 
approximation. The error in the two- term approximation is less than 1% 
for T larger than 4.0. Even the one- term approximation is accurate to 
within 5% for thresholds larger than 5.0. For practical purposes, 
determining the false-alarm rate to within 1% is probably adequate. 

5.4 Results 

The OSGLR and GLR tests ware applied to the problem of detecting 
failures in a C-130 transport aircraft. Simulation results are presented 
which allow a comparison of the performance of these two algorithms. The 
nominal flight condition is defined to be at an altitude of 304.8 m (1000 
ft) with an airspeed of 77.2 m/s (150 knots). The turbulence level used 
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0.05 
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had a standard deviation of = S.5 ft/s, which corresponds to heavy 
turbulence. The control surfaces are defined as per Table 5-2 for this 
section of the report. 

Table 5-2. C-130 control surface definition. 


Input 

Control Surface 

1 

elevator 

2 

right aileron 

3 

left aileron 

4 

rudder 

5 

right flap 

6 

left flap 


Both tests were implemented in discrete time. The Kalman filter states 
are those listed in Table 2.1 of Section 2.2. In addition, five addi- 
tional states were included in the Kalman filter to model the effects of 
turbulence. The measurements used are those described in Section 2.2. 
The measurements were assumed to be taken at a rate of 50 Hz. 

The basis functions of the OSGLR failure hypotheses were deter- 
mined by trial and error, so that good performance was achieved for many 
different failure modes. For each failure hypothesis, six basis func- 
tions were used in the truncated series expansion. Six basis functions 
were found to be adequate for all the failures simulated. The use of 
more than six sometimes caused numerical problems. The basis functions 
are the discrete-time equivalent of the Laguerre functions, with time 
constant 


T = 3.0 s 


(5.95) 
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That is, the basis functions are obtained by orthonormalizing the 
( discrete- time ) functions 




k 


i-1 


k 

z , 


1 — * 1 , 2 , •••/ 6 


(5.96) 


where 


z 


e-At/T 


(5.97) 


where At = 0.02s is the sampling interval. Other basis functions, such 
as the Legendre functions, were not tested. The results are not 
sensitive to the choice of time constant, so long as it is of the same 
order as the time scale over which the faiure is detected. 

The assumed failure mode of each GLR failure hypothesis is a step 
function (or bias) of unknown magnitude occurring at time 0. The failure 
onset time 9 is constrained to the data window t - ^ ^ ^ where 

t^ is the length of the window. The GLR test was implemented using two 
different data windows: a 2 s (100 sample) window and a 5 s (250 sample) 

window. Most of the results presented in this section are for the 2 s 
data window. 

The simulation results can be divided into two categories: those 
based on the linearized models and those based on the nonlinear simula- 
tion. For the most part, the simulation results presented are based on 
the linearized models. The reasons for this are twofold. First, the 
linear simulations demonstrate the characteristics of the OSGLR test 
unobscured by nonlinear effects. Second, the linear simulation requires 
considerably less computation than the nonlinear simulation. The 
nonlinear simulation is used to show the effects of nonlinearities and to 
generate test cases that are not easily generated using the linear 
simulation. 
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In order to determine the performance of the algorithms, a detec- 
tion threshold must be set for each* Because no performance specifica- 
tions have been given, the selection of the threshold is somewhat arbi- 
trary* We will set the OSGLR threshold so that the resulting false-alarm 
rate of each OSGLR detector is 10“^ per hour or less* Using the re- 
sults for discrete-time systems presented in Section 5*3*2 leads to 

= 56.86 


The false-alarm rate is very sensitive to the selection of the 
threshold* As a result, the threshold is not very sensitive to the 
specification of the false-alarm rate* For example, if we require that 
the false-alarm rate be decreased to 10"*^ per hour, then the threshold 
must be increased to only = 67*10* Thus, the results presented here 
will not be sensitive to the exact value of the false-alarm rate 
specification* 

It is somewhat more difficult to determine the threshold for the 
GLR test* In order to compare the GLR and OSGLR tests on a fair basis, 
we should select the threshold for the GLR test so that each GLR detector 
has the same false-alarm rate as the OSGLR detectors* Unfortunately, no 
analytic expression for the false-alarm rate of the GLR test exists* The 
false-alarm rate could be determined in principle by Monte Carlo simula- 
tion* However, the amount of simulation that would be required would be 
enormous, because of the very small rate at which false alarms occur* 
Therefore, we will simply set the GLR detection threshold to the same 
value as the OSGLR detection threshold* 

5*4*1 Linear Simulation with No Failure 

The C-130 linear simulation was used to generate Kalman filter 
residuals for the unfailed system* The duration of the simulation was 
50 s* 
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Figure 5,2 shows the OSGLR detection decision functions for the 
six actuators for this simulation. Several features in the figure are 
noteworthy. First, since each of the decision functions can be shown to 
be a central chi-squared random variable with six degrees of freedom, the 
mean value of each decision function should be 6, This fact appears to 
be verified by the figure. 

Second, some of the decision functions have peak values that 
approach 20, This is far below the detection threshold T^ = 56,86, as 
would be expected for a simulation of such short duration. 

The third noteworthy feature of Figure 5,2 is that the detection 
decision functions corresponding to the ailerons and flaps (DF^# DF^, 

DF^ , and DFg) show a striking similarity. This is not unexpected, as we 
saw in previous sections that the failure of a given wing control surface 
(aileron or flap) is not easily distinguishable from the failure of any 
other wing control surface. This was due to the fact that these four 
surfaces have similar effects on the dynamics of the aircraft. There- 
fore, the OSGLR detectors for these surfaces are similar. Hence, the 
OSGLR decision functions for these surfaces are similar, even when there 
is no failure present. This is an effect that will be apparent in all of 
the simulations, whether a wing control surface has failed or not. 

Figure 5,3 shows the GLR detection decision functions for the same 
simulation. For this case, the data window for the GLR test was 2 s long 
(100 samples). The general character of the GLR decision functions is 
somewhat different than that of the OSGLR decision functions. The de- 
cision functions seem to be somewhat noisier and to have a smaller mean 
value. 


However, there are also some similarities between Figures 5,3 and 
5,2, First, the GLR decision functions for the wing control surfaces 
(DF , DF , DF , and DF ) are all similar, although the similarity is not 

Z o D 6 
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Figure 5.2. OSGLR detection decision functions for the linear 
simulation with no failures 
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Figure 5.2. OSGLR detection decision functions for the linear 
simulation with no failures (Cont.) 
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as great as was the case for the OSGLR decision functions. Second, the 
peak values of some of the GLR decision functions are close to 20 , as was 
the case with the OSGLR algorithm. From this we may conclude that the 
assumption that the GLR and OSGLR detection thresholds are the same is 
not unreasonable. 

5*4.2 Elevator Bias Failure 

In this case, a -0.01745 rad (-1®) bias of the elevator was 
simulated, using the linear simulation. The failure occurred at time t - 
10 s of a 50 s simulation. 

Figure 5.4 shows the OSGLR detection decision functions for the 
six control surfaces. The decision functions generally have the charac- 
teristics that we expect. Immediately following the onset of the fail- 
ure, the decision function corresponding to the elevator, DF-| , in- 
creases rapidly, indicating a failure of the elevator. To a lesser ex- 
tent, the other decision functions increase as well, although they are 
always much less than DF-j . For the detection threshold selected, 
detection occurs at t = 10.22 s, 0.22 s after the onset of the failure. 

Several other features of the figure are noteworthy. First, the 

four decision functions DF^, DF^, OF , and DF_ are very nearly equal. 

2 3 5 6 

This is a characteristic that will be seen in all the simulations. It is 
simply a reflection of the fact that the four OSGLR detectors for the 
control surfaces on the wing are similar, because the effects of these 
surfaces on the aircraft are similar. Second, note that the elevator 
failure is easily isolated, because DF-| is significantly larger than 
the other decision functions. 

Figure 5.5 shows the GLR detection decision functions for the same 
simulation, using a 2 s (100 sample) data window. For the 2 s period 
immediately following the failure, the GLR detection functions closely 
resemble the OSGLR decision functions. The elevator decision function 
increases rapidly, crossing the detection threshold att= 10.12 s. 
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OSGLR DETECTION DECISION FUNCTIONS, DF- (X 10^) 



Figure 5.4. OSGLR detection decision functions for the linear 
simulation with a -0.01745 rad (-1^) bias failure 
of the elevator at time t = 10 s 
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OSGLR DETECTION DECISION FUNCTIONS, DF, 



Figure 5.4. OSGLR detection decision functions for the linear 
simulation with a -0.01745 rad (-1^) bias failure 
of the elevator at time t * 10 s (Cont.) 
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GLR DETECTION DECISION FUNCTIONS, DF- 



Figure 5.5. GLR detection decision functions for the linear 

simulation with a -0.01745 rad (-1°) bias failure 
of the elevator at time t = 10 s. A 100 sample 
(2 s) data window was used. 
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It is not surprising that the GLR detection time is less than that 
of the OSGIiR test, because the GLR hypotheses can represent the failure 
mode exactly, whereas the OSGLR hypotheses can only approximate the 
failure mode. Also, the time scale of the basis functions is x = 3 s, 
which is considerably longer than the time required to detect the fail- 
ure* If the time scale is reduced to x = 0*5 s, then the detection time 
for the OSGLR test is the same as for the GLR test* However, it was felt 
that the longer time scale was desirable to allow for failures that take 
longer to detect. Furthermore, the detection time of 0.22 s is probably 
acceptable. 

Despite the good performance of the GLR test, the algorithm does 
display some undesirable characteristics. Note that at t = 12 s (2s 
after the onset of the failure), the decision functions suddenly level 
off. This is due, of course, to the finite data window of the GLR test. 
The GLR algorithm accumulates data for only the length of the data win- 
dow, which is 2 s long in this case. After that time, information about 
the failure is lost. 

Furthermore, note that DF^ exceeds DF^ after t = 33.2 s. Had the 
threshold been larger, or the failure been smaller, the GLR test could 
have isolated the failure to the wrong component, namely, the right 
flap. The reason for this behavior is again related to the data window. 
After t = 12 s, the actual failure (a step failure at t = 10 s) is not 
one of the failures considered by the GLR test. Therefore, the behavior 
of the algorithm is unpredictable after t = 12 s. 

The OSGLR test does not have the undesirable characteristics of 
the GLR test discussed above. The OSGLR hypotheses can represent the 
step failure, at least approximately, over a long time period, even 
though the approximation is somewhat inaccurate for a very short time 
period. Over a long time period, the OSGLR test continues to accumulate 
information about the failure. As a result, the OSGLR test does not 
display the characteristics of the GLR test which are associated with the 
finite data window. 
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5.4 .3 Rudder Bias Failure 


In this case, a 0.0349 rad (2®) bias of the rudder was simulated, 
using the linear simulation. The failure occurs at time t = 10 s of a 
50 s simulation. 

Figure 5.6 shows the resulting OSGLR detection decision func- 
tions. In many ways, this simulation resembles that of the elevator. 

The decision function corresponding to the failed component, DF 4 , 
increases rapidly following the onset of the failure. The other decision 
functions increase also, but much more slowly than DF 4 . The failure is 
detected at t = 13.06 s, 3.06 s after the beginning of the failure. 

The conclusion which can be drawn is that rudder failures are easily 
distinguishable from the other actuator failures. This is demonstrated 
by the extremely large difference between DF 4 and the other decision 
functions . 

Figure 5.7 shows the GLR detection decision functions for this 
simulation, using a 2 s (100 sample) data window. After the onset of the 
failure, the rudder decision function, DF 4 , increases quickly, indicat- 
ing a failure of the rudder. The other five decision functions increase 
little, if any. The failure is detected at t= 11.80 s, when DF 4 ex- 
ceeds the detection threshold. Shortly thereafter, at t = 12 s, DF 4 
abruptly changes character. At this time, DF 4 levels off, except for 
wide fluctuations due to noise. Again, this behavior is attributable to 
the finite data window of the GLR test. Note that had the detection 
threshold been only slightly larger, say, T^ = 75, then the detection 
time would have been greatly increased, from 1.08 s to 7.08 s. 

Note that the detection time for the OSGLR test is somewhat longer 
than for the GLR test. The reason for this is as follows. The step 
failure in the rudder causes rapid changes in the mean values of some of 
the Kalman filter residuals. The OSGLR hypotheses are unable to 
accurately represent the discontinuities in the residuals. Therefore, 
some of the energy of the failure signature cannot be used by the OSGLR 
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GLR DETECTION DECISION FUNCTIONS, DF- 



TIME, t (seconds) 

Figure 5.7. GLR detection decision functions for the linear 

simulation with a 0.0349 rad (2^) bias failure of 
the rudder at time = 10 s. A sample (2 s) data 
window was used. 
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algorithm to detect the failure. On the other hand, the GLR hypotheses 
can represent the failure signature exactly within the data window. 

The overall performance of the OSGLR test for this case is 
generally good. Although the detection time is slightly longer for the 
OSGLR test than for the GLR test, the OSGLR algorithm appears to be more 
robust than the GLR algorithm. 

5.4.4 Right Aileron Bias Failure 

In this case, the linear simulation was used to simulate a 
0.0175 rad (1®) bias failure of the right aileron. The failure occurred 
at time t=10 sof a 50 s simulation. 

Figure 5.8 shows the OSGLR detection decision functions for this 
simulation. Immediately following the failure, these four decision 
functions corresponding to the wing control surfaces (^^ 2 ' ^^ 3 ' ^^ 5 ' 

DFg) begin to rise steadily. To the scale of the plot, these four de- 
cision functions cannot be distinguished. The elevator decision function 
(DF^ ) also rises steadily following the failure. On the plot, DF-j 
appears to be close to the four decision functions of the ailerons and 
flaps. On an absolute scale, however, this difference is large. Fi- 
nally, the rudder decision function (DF 4 ) also increases somewhat, al- 
though not nearly so much as the other five decision functions. For the 
detection threshold given, the detection occurs 0.56 s after the onset of 
the failure. 

In order to determine which of the four detection decision func- 
tions of the wing control surfaces is largest following the failure, 

(some of) the OSGLR isolation decision functions are plotted in Fig- 
ure 5.9. The isolation decision function DFj^j is defined to be 


DF. . = DF. - DF. (5.96) 

ID 1 D 

Shown in the figure are DF^_, DF^_, and DF„. Following the failure, all 

23 2d 2o 
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OSGLR DETECTION DECISION FUNCTIONS, DF- (X 10^) 





Figure 5.9. OSGLR isolation decision functions for the linear 
simulation with a 0.01745 rad (1°) bias failure of 
the right aileron at time t = 10 s 
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three of these isolation decision functions are positive, correctly 
indicating that the right aileron is the surface that has failed. Also, 
except for a brief period immediately following the failure. 


DF 


26 


> DF 


25 


> DF 


23 


These results imply that it is relatively easy to distinguish between 
failures of the right aileron and the elevator or rudder, but 
progressively more difficult to distinguish a right aileron failure from 
the failure of the left flap, the right flap, and the left aileron. 

Note that because the failure of the right aileron is barely 
distinguishable from failures of the other three wing control surfaces, 
it would be wise to use an isolation threshold for this system to prevent 
incorrect isolations. We have not attempted to determine an isolation 
threshold for this study. However, it is clear that an isolation thresh- 
old that is large enough to be effective at preventing incorrect isola- 
tions will cause a significant delay in the isolation of the failure, 
perhaps 10 s or more. 

Figure 5.10 shows the GLR detection decision functions for this 
simulation. (Note the difference in scale from Figure 5.9.) In many 
respects. Figure 5.10 resembles Figure 5.8. Immediately following the 
failure, the aileron and flap decision functions increase rapidly. At 
t = 12 s, however, the rate of increase of these decision functions 
slows, due to the finite data window. To a lesser degree, the elevator 
and rudder decision functions increase also. Detection occurs 0.48 s 
after the failure. 

Figure 5.11 shows the GLR isolation decision functions DF 23 / 

DF , and DF... Note that the GLR isolation decision functions are 
25 26 

somewhat smaller than the OSGLR isolation decision functions (cf Figure 
5.9). Once again, this is because the finite data window limits the 
amount of information that can be accumulated about the failure. Also 
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TIME, t (seconds) 


Figure 5.11. glr isolation decision fvinctions for the linear 

simulation with a 0.01745 rad (1°) bias failure of 
the right aileron at time t = 10 s. 
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note that even as late as 7.5 s after the failure, ^>^23 occasionally 
negative, indicating that the failure is in the left aileron, rather than 
the right aileron. Even at t = 26 s, 16 s after the failure, DF 23 is 
close to zero. Thus, the behavior of the OSGLR test seems to be more 
robust for this case. 

5.4.5 Rudder Ramp Failure 

The failures simulated thus far have all been step bias failures. 
This puts the GLR test at an advantage, since the GLR test assumes a bias 
failure mode, \idiereas the OSGLR test assumes a more general failure mode 
shape. To see how these tests perform with a different failure mode, a 
ramp failure of the rudder was simulated, using the linear simulation. 

The ramp begins at t = 10 s, and the ramp increases at a rate of 
0.001745 rad/s (0.1 deg/s). 

Figure 5.12 shows the resulting OSGLR decision functions. The 
decision functions change very little until about t = 15 s. At that 
time, the rudder decision function begins to increase, albeit slowly at 
first. As the magnitude of the failure increases, DF 4 increases more 
rapidly. DF 4 crosses the detection threshold at t = 23.08 s, so that 
the time to detection is 13*08 s. Meanwhile, the other five decision 
functions increase only slightly until about t = 24 s, at which time 
these decision functions begin to increase. Thus, this failure is easily 
detected using the OSGLR test. 

Figure 5.13 shows the GLR detection decision functions for this 
simulation, using a 2 s (100 sample) data window. This figure is similar 
to Figure 5.12, except that the decision functions are generally smaller 
than for the OSGLR test. Also, DF 4 seems to be quite a bit noisier. 

The detection time for the GLR test is 18.88 s, which is significantly 
longer than for the OSGLR test. The major reason for this is that the 
data window is too short to allow enough data to be accumulated to detect 
the failure. 
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To demonstrate this last point, the GLR data window was increased 
to 5 s (250 samples) (Figure 5.14). In this case, DF 4 increases more 
rapidly than with the 2 s data window. The detection time for this case 
is 14,90 s, which compares favorably with the OSGLR test, although the 
OSGLR test still performs slightly better than the GLR test in this case, 

5,4,6 Nonlinear Simulation with No Failure 

This simulation is similar to that of Section 5,4*1, except that 
the nonlinear simulation was used instead of the linear simulation. In 
this case, it was necessary to implement the Kalman filter in order to 
generate the residuals. 

Figure 5,15 shows the OSGLR detection decision functions for the 

nonlinear simulation with no failures. Ideally, the decision functions 

should resemble those of Figure 5,2, However, the decision functions in 

this case are quite different. Specifically, the decision functions for 

the wing control surfaces (DF , DF , DF-, and DF ) have peak values of 

2 3 5 6 

approximately 500, which is a factor of 25 larger than the peaks seen in 
Figure 5,2, This effect is due to the differences between the nonlinear 
model and the linearized model generated frc»n it. It was determined that 
the greatest source of error is due to mismodeling of the aerodynamic 
moments about the roll axis. This produces a bias in the estimate of 
roll rate, which is small compared to the standard deviation of the 
estimation error. However, this bias is integrated by the Kalman filter 
to produce a very large bias in the estimate of the bank angle. This in 
turn caused the residual associated with the bank angle measurement to 
be significantly biased. Because the four wing control surfaces 
primarily affect the roll axis, the decision functions associated with 
these surfaces are the ones most affected by this modeling error. The 
decision function associated with the elevator is also affected, because 
elevator deflections cause a moment about the roll axis, due to coupling 
between the longitudinal and the lateral dynamics. To a lesser extent. 
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Figure 5.15. OSGLR detection decision functions for the nonlinear 
simulation with no failures 
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the rudder decision function is also affected, because the rudder can 
produce motion in the roll axis. However, the rudder is not as effective 
in producing rolling moments as the flaps, ailerons, or elevator (at this 
flight condition) • Therefore, the rudder decision function is not as 
large as the others* 

Figure 5.16 shows the GLR detection decision functions for the 
same simulation. Again, a 2 s (100 sample point) data window was used. 

As was the case with the OSGLR algorithm, the GLR decision functions are 
larger for the nonlinear simulation than for the linear simulation. In 
this case, the decision functions corresponding to the control surfaces 
on the wing reach peak values of approximately 35. This is much lower 
than the peak values of the OSGLR decision functions. There are two 
reasons for this. First, the GLR data window is relatively short. The 
energy in the residuals due to the biases in the estimation error is 
correlated over a time period much longer than 2 s. Hence, we might 
expect that a GLR detector with a longer data window would produce much 
larger decision functions. In fact, this is the case, as shown by Fig- 
ure 5.17, which shows the GLR detection decision functions using a 5 s 
(250 sample) data window. (Note the difference in scale from Fig- 
ure 5.16). In this case, the decision functions corresponding to the 
control surfaces on the wings have peak values of approximately 75, which 
is about twice as large as the peak values using a 2 s window. 

The other reason that the GLR decision functions are smaller than 
the OSGLR decision functions is more subtle. Essentially, each GLR or 
OSGLR detector finds the failure input f(t) which generates a mean proc- 
ess in the residuals that most closely matches the observed residual 
process. However, the GLR algorithm considers (in this case) only step 
failures, whereas the OSGLR algorithm considers more general failure 
modes. Hence, the OSGLR algorithm can find cunong its hypotheses a fail- 
ure input time history that matches the observed residuals more closely 
than does any of the step failures considered by the GLR algorithm. 

Thus, the same property of the OSGLR algorithm that makes it robust to 
failure mode uncertainty also makes it more sensitive to modeling errors. 
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Figure 5.17, GLR detection decision functions for the nonlinear 
simulation with no failures and a 5 s (250 sample) 
data window 
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5.4.7 Stuck Elevator 


In this case, the nonlinear simulation was used to simulate a 

stuck elevator. Such a failure might be caused, for example, by a jam of 

a mechanical linkage. The elevator was struck at 6 = 0.0977 rad 

E 

(0.56®)* By comparison, the trim valve of the elevator deflection is 
approximately 6 = 0.020 rad (1.15®). The failure occurred at time t = 10 
s of a 50 s simulation. Figure 5.18 shows the resulting error in the 
elevator position, i.e., the difference between the actual elevator 
position and the commanded elevator position. Note that the history of 
the error does not fit into any easily characterized category, such as a 
bias or ramp failure. 

Figure 5.19 shows the resulting OSGLR detection decision func- 
tions. The OSGLR test performs quite well in this case, despite the 
complexity of the failure input. Approximately 1 s after the onset of 
the failure, the elevator decision function, DF^ , increases rapidly, 
indicating a failure. The other five decision functions also increase, 
but they are always significantly smaller than DF^ . For the threshold 
selected earlier, the failure is detected at t = 11.94 s. (Note, 
however, that this threshold would not be used unless the problem of 
modeling errors had been addressed.) 

Figure 5.20 shows the GLR detection decision functions for this 
case, using a 2 s (100 sample) data window. For the 3 s immediately fol- 
lowing the onset of the failure, the GLR decision functions resemble the 
OSGLR decision functions. (cf. Figure 5.19.) DF^ increases rapidly, 
indicating a failure of the elevator. For the threshold selected, the 
detection of the failure occurs att= 12.14 s, 2.14 s after the onset of 
the failure. This is not significantly different from the OSGLR test. 

However, this result is somewhat misleading. Note that at about 
t = 13 s, DF^ begins to decrease for the GLR test, until at t = 15 s it 
is at about the same value that it had before the failure. For a brief 
time, the four decision functions corresponding to the control surfaces 
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Figure 5.18. Error in elevator deflection due to stuck elevator 
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! 

Figure 5.19. OSGLR detection decision factions for the nonlinear 
simulation with a stuck elevator at time t = 10 s 
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Figure 5.20. GLR detection decision functions for the nonlinear 
simulation with a stuck elevator at time t = 10 s. 
A 2 s (100 sample) data window was used. 
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on the wing exceed DF-; . At t = 16 s, DF-j again increases until 
t = 18 s, where once again DF^ decreases slightly. At eQ>out t = 19 s, 

DF^ exceeds DF^ slightly. Shortly thereafter, DF^ begins to increase 
steadily auid is always greater than the other decision functions. 

Also, note that if the detection threshold is increased (e.g., to 

account for modeling errors), then the decision time is likely to in- 

2 

crease significantly. For example, if the threshold is set to T = 200, 
then the time of the detection would be t = 22.52 s, 12.52 s after the 
failure. On the other hand, the time to detection for the OSGLR test for 
this threshold is only 6.82 s. 

This behavior is caused by two separate effects. The first is the 
relatively short (2 s) data window. Thus, when the failure input sub- 
sides in the vicinity of t = 15 s (Figure 5.18), the GLR decision func- 
tions also decrease. 

The other reason for this behavior is that the actual failure mode 
does not agree with any of the hypothesized failure modes of the GLR 
algorithm. As a result, the results of the test are unpredictable. In 
particular, DF-| is sometimes less than the other decision functions. 

As a result, we see that the GLR test is not robust. On the other hand, 
the failure mode can be represented, at least approximately, by the OSGLR 
failure hypotheses. As a result, the OSGLR test is robust to failure 
mode uncertainty, and does not have the undesirable properties of the GLR 
test displayed in Figure 5.20. 

Finally, note that increasing the length of the GLR data window to 
5 s (250 samples) improves the performance of the GLR test only slightly 
(Figure 5.21). Immediately following the failure, the behavior of the 
decision functions is the same as for the GLR test with a 2 s data win- 
dow. Following time t = 12.5 s, however, DF^ declines only slightly, 
whereas ^^6 increase. At about t = 

17.5 s, these four decision functions all exceed DF-j . It is not until 
t = 19 s that DF-^ again is the maximum decision function. With the 
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Figure 5.21, GLR detection decision functions for the nonlinear 
simulation with a stuck elevator at time t = 10 s. 
A 5 s (250 sample) data window was used. 
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threshold = 56.86, the detection time is 2.14 s, which compares 
favorably with the OSGLR test. However, for the threshold = 200, 
the detection time is 9.79 s, which is somewhat longer than the detection 
time for the OSGLR test with that threshold. 

5.4.8 Summary 

As measured by the time required to detect a failure, it would 
appear that the performance of the OSGLR test is roughly comparable to 
that of the GLR test. Table 5.3 summarizes the detection times of the 
two tests for the control surface failures simulated. Generally, the 
performance of the GLR tests is better when the failure mode simulated is 
the same as one of those hypothesized in the GLR failure hypotheses. For 
other failure modes, the OSGLR test performs better. Nevertheless, the 
detection times are comparable for all of the failures. 

However, the results presented in Table 5.3 are somewhat mislead- 
ing. In almost all of the test cases, the GLR test exhibited nonrobust 
behavior. This is caused by two features of the GLR test. First, in 
order to make the GLR test computationally feasible, it is necessary to 
restrict the hypothesized time of failure by using a data window. As a 
result, if detection does not occur when the time of the failure is 
within the data window, then information about the failure is lost. 
Second, the GLR test assumes a particular failure mode. Consequently, 
the behavior of the test is not predictable when a different failure mode 
occurs. 
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Table 5*3 • Summary of the detection performance of the OSGLR 
and GLR tests. 



Time to 

Detect Failure (s) 

Failure Mode 
Simulated 


GI 

^R 

OSGLR 

2 s Data 
Window 

5 s Data 
Window 

-0.01745 rad(-1.0®) 
Elevator Bias 

0.22 

0.12 

0.12 

0.0349 rad(2.0») 
Rudder Bias 

3.06 

1 .80 

1 .80 

0.01745 radd.O®) 
Right Aileron Bias 

0.56 

0.48 

0.48 

0.001745 rad/s 
(0.^o/s) 

Ramp Rudder 

13.08 

18.88 

14.90 

stuck 

Elevator 

1 .94 

2.14 

2.14 


On the other hand, the OSGLR test does not exhibit these undesir- 
able characteristics. The test can continue to accumulate information 
about a failure for as long as the truncated series expansion of the 
OSGLR failure hypothesis can adequately represent the failure. Also, the 
series expansion can represent, at least approximately, many different 
failure modes. Therefore, the OSGLR test is robust to failure mode 
uncertainty, whereas the GLR test is not. 

Furthermore, the OSGLR test requires far less computation than 
does the GLR test, at least in this case. Table 5.4 summarizes the 
computational requirements of the two tests. Each number in the table is 
the ratio of the CPU time required to run a particular test to the length 
of the simulation for which the test was implemented. The tests were 
implemented in FORTRAN on a Digital Equipment Corporation VAX 11/780. 
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For each test, six detectors were implemented, corresponding to the six 
control surfaces. The GLR test requires 18.5 or 46.2 times more compute- 

tion than the OSGLR test, depending on whether a 2 s or 5 s data window 
is used for the GLR test. 


Table 5.4. Computational requirements of the OSGLR 
and GLR algorithms# 


Ratio of Cl 

PU Time to Simulation Time 

OSGLR 

GLR 

6 Basis 
Functions 

2 s Data 
Window 

5 s Data 
Window 

0.686 

12.66 

31 .66 


one dieedvantage of the OSQLR teet is that it appears to be 
sensitive to modeling errors than the GLR test. 


more 
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CHAPTER 6 


DISTINGUISHABILITY OF FAILURES 


6.1 Introduction 

In some systems, the failure of one component may closely mimic 
the effects of the failure of another component* In such systems, it 
may be impossible to distinguish between different types of failures, 
regardless of the FDI algorithm used* Therefore, quantitative measures 
would be desirable to indicate to what extent the failures of different 
components are distinguishable* The measures would serve two purposes: 
First, they could be used to alert the system designer that a change in 
the system is needed to achieve fault tolerance* Such a change could 
be, for example, the addition of more sensors or the change in location 
of an actuator. Second, the measures may be used to determine whether 
the inability of a particular FDI algorithm to isolate failures is a 
deficiency of the algorithm or a property of the system* 

In this section, two measures of distinguishability are proposed 
(Reference 10)* The first of these is interpreted as the distance 
between two failure hypotheses, assuming that one failure mode is fixed 
and that the other failure mode is allowed to take on its worst-case 
value* Based on a geometric interpretation of this distance, a second 
measure of distinguishability is defined, which is interpreted as the 
angle between the hypotheses* 
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6.2 


Distance Measure 


The distinguishability measure presented below will measure how 
closely the failure of one component, say component j, can mimic the 
failure of another component, component i, when the failure mode of 
component i is given* If the failure mode of component j is thought of 
as an unknown control, and "how closely" is interpreted as implying a 
cost function, then this formulation could be expected to lead to some 
sort of optimal control problem. As shown below, this is indeed the 
case* 

We will formulate the problem as follows: First, it is assumed 

that the observation interval [tQ, tf] is fixed* Next, the failure 
mode of component i is specified to be some function, fj^(t)* For the 
time being, it is assumed that the failure mode fj(t) is specified as 
well. Note that for either failure, the onset time of the failure, 0, 
may be anywhere in the interval [tQ, t^] * Then the problem of de- 
termining which component has failed is a binary hypothesis testing 


+ w(t) + ^^(t)f^(t) (6*1) 

+ v(t) + ^^(t)f^(t) (6*2) 

+ w(t) + b. (t)f . (t) (6*3) 

— -3 3 

+ v(t) + d^(t)f^(t) (6*4) 

fj^(t) and fj(t) are assumed 
rather than composite. 


problem, with hypotheses 


dx( t) 


H. : 


i dt 


= A(t)x(t) 


y(t) = c(t)x(t) 


dx(t) 


H. 


j dt 


= A(t)x(t) 


y(t) = C(t)x(t) 


Note that because the failure modes 
known, these hypotheses are simple. 


142 



The data ^ t ^ t^} will be reduced to a sufficient 

statistic which contains all the information about the two hypotheses. 
To begin, the data are filtered using a Kalman filter based on the 
unfailed (H^) system equations 

d3c( t) 

Hq: — = A(t)x(t) + w(t) (6.5) 


y(t) = c(t)x(t) + v(t) 


( 6 . 6 ) 


The hypotheses and Hj can then be written as 

H, : Y(t) = Y,^(t) +m.(t) (6.7) 

1 — — Kj — 1 

H.: Y(t) = Y*(t) +m.(t) (6.8) 

where j[(t) is the Kalman filter residual, and JYQ('t) is a zero-mean, white 
Gaussian process with intensity R(t). mj^(t) and mj(t) are the means 
in the residual jf(t) under and H j , respectively. 

The sufficient statistic for this problem is given by 


X 



[m.(t) - m^(t) (t)j(t) dt 


(6.9) 


Because _y(t) is a Gaussian random process, x is a Gaussian random vari- 
able. The mean of x under is given by 


Similarly, the mean of x under Hj is given by 



( 6.11 ) 


The variance of x under is given by 


S 


E[( X - 


2 



( 6 . 12 ) 


The final expression for the variance is 


S 



m (t)]**^ R \t)[m.(t) - m.(t)] dt 

— 1 —j —1 


( 6 . 13 ) 


The variance of x under Hj is also given by S. 

Thus, the problem of deciding whether or is true has been 
reduced to that of deciding whether the Gaussian random variable x has 
mean X^^ Xj • The parameter that determines the performance that can be 
achieved under these circumstances is the signal-to-noise ratio, defined 
by 


d 


2 


s 


But it can be shown that 


^ - 


^i 


s 


( 6 * 14 ) 


( 6 . 15 ) 


Therefore^ 
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d = S 


So the distance between the hypotheses is defined to be 


(6*16) 


d 


J/2 


(6,17) 


The distance d is simply the number of standard deviations that separate 
the conditional means xi X2* 

Up to this point, it has been assumed that both failure modes 
fi(t) and f,(t) are known. However, what we really want is to find the 
failure mode f^(t) that most closely mimics the failure mode f^(t). In 
other words, we want to find the distance between the hypotheses for the 
worst-case fj(t). Therefore, the distinguishability measure 
(f j^( •) , t^) is defined by 


A..(fi(.), tf) = 


min d 

f.(t, 

v'i'f 


or alternatively. 


(6.18) 


(£ (•), t ) = min / ^ [m. (t) - m. (t)]^ R~^ (t) (m. (t) -m. (t)] dt 

^ ^ f.(t) ^0 

t^t£t^ (6.19) 

2 

The problem of determining A^^ has two interpretations. The 
obvioxis interpretation is as an optimal control problem and the problem 
may be recognized as being equivalent to the optimal linear quadratic 
tracking problem. A less obvious interpretation is that the cost 
function to be minimized is the same as that which is minimized to solve 
the optimal least-squares filtering problem. In this case, fj(t) is 
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interpreted as infinite variance noise driving the state _e(t), rather 
than as a control input* 

6.3 Geometric Interpretation 

In this section, a geometric interpretation of the distance meas- 
ure Z^j will be provided* Based on that interpretation, a relative 
measure of distinguishability will be defined* 

Consider the continuous- time case* The set of square-integrable, 
m-dimensional vector functions on the interval [tQ, tf] is denoted 
by ^f^' simply is a complete, infinite-dimensional 

vector space* A valid inner product for is defined by 

,^f T — 1 

R (t) in (t) dt (6*20) 

^ tg 1 2 

where R(t) is a symmetric, positive definite matrix* If the norm for 
L™ is defined by 


m( •) = <m( •), in( 


( 6 * 21 ) 


then is a Hilbert space* 

Given this background, the problem of determining Aj^j may be 
succinctly stated as 


A. . 

= min 

|U. - m.ll 

13 

m. eV. 
n 3 

1 l“D —ill 


( 6 * 22 ) 


where V. is the subspace of that is the set of all valid m.(«)* 

3 2 -3 

By the orthogonal projection theorem, the minimizing i||k(*)/ denoted by 
m* ( • ) , is the unique m* ( • ) eV ^ such that 

<m.(»)-m*(«), m.(»)> = 0 for allm.(») eV. (6*23) 

—3 —3 “3 3 
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In other words, m*{*) is the projection of m. ( •) onto V., 

“1 D 

sentation error 


and the repre- 


m ( • ) - m* ( • ) 

1 -O 


( 6 . 24 ) 


is orthogonal to the subspace Vj. In particular, 

<m. (•) - m.(0> = 0 (6.25) 

That is, the representation error is orthogonal to m*(»). This situa- 
tion is represented graphically in Figure 6*1* In the figure, the vec- 
tor space L™ is depicted as being spanned by _e , e ^ e , whereas the 

subspace V. is spanned by ^ and ^ . A. . is simply the length of the 
3 12 

vector m.(«) - m*(*). 

Based on this geometric interpretation, a relative measure of 
distinguishability, ^ ^f^' will be defined as the angle between 

^(•) and m*(*). Because the representation error is orthogonal to the 
projection, otj^j is given by 


ij 



But by definition. 


A. . 
ID 


m 


( • ) - m* ( • ) 


Therefore, 


a. . 
ID 


= sin 


-1 


ID 


£Li( 


(6.26) 


(6.27) 


(6.28) 
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Figure 6.1. 


Geometric interpretation of the orthogonal 
projection theorem* 


As a practical matter, both Oj^j and Aj^j are useful measures 
of the distinguishability of failures* As noted earlier, if A^j/2 is 
small, say on the order of unity or less, then it will not be possible 
to isolate a failure of component i or j (with failure mode f^( •) or 
fj(»)) reliably* If ^^j/2 is small, but is large (say, greater than 
0*349 rad or 20®), the problem is that the energy in the failure 
signature •) is small, not that the two failure types are similar* 

On the other hand, if ^ij/2 is large, but o^j is small (say, 
less than 0*08725 rad or 50®), then isolation should be possible, given 
knowledge of f^( •) and fj(*), and given that the system model is 
accurate* However, the isolation performance is likely to be sensitive 
to failure mode uncertainty, modeling uncertainty, and of course to the 
actual (sequential) FDI test used* 

6*4 Results 

The distinguishability measures just defined will be used to 
determine the degree to vdiich failures of the control surfaces for the 
C-130 aircraft system are distinguishable from one another* 

Recall that the distance between two hypotheses and ^ , 

and the angle between two hypotheses, j # functions of the (assumed) 

failure mode of H^, f^(t)* For the purposes of this section, only one 
type of failure mode was assumed, namely, a step bias failure occurring 
at time 6* Note that because the system is time-invariant and the Kalman 
filter is (assumed to be) operating in steady state, the time origin may 
be shifted arbitrarily* Therefore, the distinguishability measures are 
functions of t - 0, the length of time since the onset of the failure* 

Figure 6*2 shows the distinguishability measures A-jj and o^j 
for a 0*01745 rad (1®) bias failure of the elevator* The subscripts i 
and j refer to the vehicle control surfaces as defined by Table 5*2* 

The five are greater than 0*61075 rad (35®) for 10 s after the 

failure, and are larger than 0*61075 rad (35®) soon after the failure* 
This indicates that on a relative basis, an elevator bias failure is 
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ANGLE, a, j DISTANCE, A 






easily distinguishable from the failure of any other control surface* On 
an absolute basis, all the A^j's are larger than 21 by time t - 0 = 1 
s, which is quite large* Therefore, we expect that for a well-designed 
FDI test, failure detection and isolation of a 0.01745 rad (1®) bias 
failure of the elevator should take less than 1 s* 

Figure 6*3 shows the distinguishability measures for a 0*01745 
rad (1®) bias failure of the rudder* Note that all the a 4 j's are 
greater than 1*2564 rad (72®) for the entire time of the plot* That is, 
the failure signature of a rudder failure is nearly perpendicular to any 
failure signature that can be generated by any other control surface 
failure* On the other hand, the A 4 j’s are relatively small* At t - 0 
= 2 s, the five A 4 j*s are about 4*0, vdiich is small* This is simply a 
reflection of the fact that the signal- to-noise ratio (d^) of the 
rudder failure (when tested against the hypothesis that no failure has 
occurred) is small* The conclusion is that if a rudder failure is large 
enough to be detected, then it will be easily distinguishable from 
failures of the other control surfaces* 

Figure 6*4 shows the distinguishability measures for a 0*01745 

rad (1®) bias failure of the right aileron* This figure is quite 

different from the previous two* In particular, the distinguishability 

measures associated with the left aileron, the right flap, and the left 

flap (corresponding to the subscripts 3, 5, and 6 , respectively) are 

small* Except for the first 1*0 s following the failure, U 25 is less 

than 0*26175 rad (15®), U 25 is less than 0*1745 rad (10®), and is 

less than 0*08725 rad (5®)* a , a , and a all decrease as the time 

23 25 26 

after failure, t - 6 , increases. Therefore, a failure of the right 
aileron is not very distinguishable from failures of another wing control 
surface (flap or aileron) based on the relative measure 02 j. 

The failure that most closely resembles the right aileron failure 
is, not surprisingly, a failure of the left aileron. As indicated by the 
distance measure ^ 23 / a failure of the right aileron is barely distin- 
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TIME AFTER FAILURE, t-0 (seconds) 

Figure 6.4. Distinguishability measures for a 0.01745 rad 
bias failure of the right aileron 
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guishable from a failure of the left aileron. Even after 10 s, A 23 is 
only 4*6/ which is too small to ensure reliable isolation^ even by a 
well-designed FDI test. Of course, if the failure were larger than 
0,01745 rad (1®) would scale proportionally. Nevertheless, these 
results indicate that aileron failures are difficult to isolate. This 
was clearly evident in the simulation results. 

Figure 6,5 shows the distinguishability measures for a 1 percent 
bias failure of the right flap. This figure is qualitatively similar to 
Figure 6,4. That is, the distinguishability measures associated with the 
other three wing control surfaces (in this case, the left flap, and the 
right and left ailerons) are small. In this case, the failure that most 
resembles the right flap failure is a failure of the right aileron. 
However, the failure of the right flap is somewhat more distinguishable 
(as measured by CX 52 ) ilian was the failure of the right aileron (as 
measured by 023 ). 10 s after the onset of a failure, 052 = 2,98, 

whereas U 23 = 1,63, 

The results presented in this section may be explained in terms of 
the aircraft's dynamics. The elevator's primary effect is to produce a 
moment ahoxxt the pitch axis. The other control surfaces do not produce 
significant moments about the pitch axis. Therefore, an elevator failure 
is easily distinguished from failures of the other control surfaces. 
Similarly, the rudder's primary effect is to produce a yawing moment, 
whereas none of the other control surfaces produce significant moments 
about the yaw axis. Therefore, rudder failures are easily distinguished 
from other failures. 

On the other hand, the primary effect of the ailerons is to pro- 
duce a moment about the roll axis. Furthermore, even though their pur- 
pose is to produce lift, flaps produce significant rolling moments when 
operated differentially. In that regard, they behave very much like 
ailerons. Therefore, it is not surprising that a failure of one of these 
four control surfaces is not very distinguishable from failures of the 
other three. 
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Figure 6.5. Distinguishab; 

bias failure < 




Furthermore, the results concerning distinguishability are 
consistent with the FDI simulation results presented for the detection 
filter and likelihood ratio tests. They suggest that the ability to 
detect and isolate failures is more a function of the physics of the 
problem and less algorithm specific. 
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SECTION 7 


A COMPARISON OF FDI ALGORITHMS 


7.1 Introduction 

The purpose of this section is to make qualitative comparisons of 
the FDI algorithms being evaluated for the Res true turable Control System 
application. These comparisons are based on the test cases used to 
evaluate each algorithm. Thresholds were not selected in all cases and a 
general detection and isolation logic was not developed. Only a limited 
number of flight conditions and environments were simulated. Yet we 
believe that a sufficiently accurate picture of the capabilies of each 
algorithm Wcus obtained, allowing the algorithms to be qualitatively 
compared. In comparing the four algorithms evaluated, the following 
issues have been considered: 

• Failure modes (bias, stuck, ramp, etc.) that can be detected. 

• Type of failure (rudder, elevator, etc.) that can be detected 
and isolated. 

• Magnitude (or degree) of failures that can be detected. 

• False alarm performance. 

• Detection time (time delay between failure and detection). 

• Computational burden 

• Robustness 

• Maturity 

These issues will now be addressed individually. 
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7.2 


Failure Modes 


Failure modes describe the behavior of the failed surface. Some 
of the important failure modes for res true turable control applications 
are stuck, hardover, and bias failures and the loss of part or all of a 
surface. The 2 JDility of the algorithms to detect these and other failure 
modes will be considered here. Note that bias failures were used most 
extensively to test the algorithms in this evaluation. Therefore, the 
ability of each algorithm to detect other failure modes was based on its 
theoretical capabilities in certain instances. 

The GLR test uses models of failure modes to detect failures. It 
is therefore, most capable of detecting the modes that are modeled. 
However, each mode modeled requires a separate bank of filters which 
makes modeling even a small number of possible modes computationally 
costly. The bias failure mode is the easiest mode to model that is 
applicable to control surface failure detection and isolation. The 
ability of the GLR test with only the bias failure mode modeled to detect 
failure modes other than a bias was considered in Section 5.4.5. A 
0.001745 rad/s (0.1 deg/s) rudder ramp failure was detected in 14.90 s 
with a 5 s data window. 

The OSGLR algorithm is similar to the GLR algorithm except that 
the failure modes are represented by a truncated series expansion rather 
than a fixed function. The series expansion chosen and the number of 
terms used determine how well a particular failure mode can be represent- 
ed. In addition, representing the high-frequency portion of the actuator 
or control surface failure is not necessary as the plant is a low-pass 
filter. Using the first six terms in the expansion, the OSGLR test was 
able to detect bias failures. These same six terms should be adequate to 
detect most other failure modes. This was demonstrated for a 0.001745 
rad/s (0.1 deg/s) rudder ramp failure vdiich was detected in 13.08 s. 

One advantage of both the unmodified and the modified detection 
filter is that all failure modes should be detectable as the residual 
direction is independent of the failure mode, depending only on the 
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surface which failed. However, for the unmodified detection filter the 
planar test used to detect failures assumed that the failed control 
surface was not oscillating about the desired control surface position. 
Even with this restriction, the unmodified detection filter should still 
be able to detect most failure modes. 

7.3 Type of Failure 

All four algorithms were able to detect elevator, rudder, right 
and left aileron, and right and left flap failures. The left and right 
elevators were assumed to move together as a unit. Elevator failures 
could be isolated by all four algorithms as could rudder failures. How- 
ever, isolating wing surface (aileron and flap) failures was difficult 
for all of the algorithms. The modified detection filter seemed to 
display some ability to distinguish between wing surfaces for moderate 
failures (0.0349 rad (2®) aileron bias, 10% flap bias) in minor turbu- 
lence. Based on the few test cases simulated, the modified detection 
filter could isolate a wing surface failure to one of two possible 
surfaces. The detection filter algorithm could eliminate one wing 
surface from consideration at most. It was demonstrated that false 
isolation could result with the GLR algorithm. Isolation to a specific 
wing surface is possible with the OSGLR algorithm with a significant 
delay of perhaps 10 s or more. 

7.4 Magnitude of Failure 

The magnitude of the failures that can be detected depends on the 
sensor noise, disturbances, and modeling errors. The GLR and OSGLR 
algorithms were able to detect moderate (0.01745 rad(1®) elevator, rudder 
and aileron) bias failures in the presence of noise and severe turbulence 
( cr^ = 1.98 m/s or 6.5 ft/s). The OSGLR algorithm appears to be more 
sensitive to modelling errors than does the GLR algorithm. 
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Turbulence and modeling errors significantly degraded the 
ability of the detection filter to detect failures. Moderate (-0.0349 
rad or -2® elevator, aileron, and 10% flap) failures could be detected in 
minor turbulence ( 0*3 in/s or 1 ft/s). However, detecting moderate 
failures in severe turbulence was more difficult. While hardover 
failures were not tested, they should be easily detected even in severe 
turbulence. Modeling errors also degraded the ability of the detection 
filter to detect moderate failures. In fact, some moderate aileron 
failures were no longer detectable. Detection of hard failures, though, 
should still be possible. 

The modified detection filter could also detect moderate failures 
in minor turbulence. The detection of failures in severe turbulence or 
with modeling errors would require dynamic thresholds or a method of 
estimating the nominal no-failure residuals caused by severe turbulence 
and modeling errors. 

7.5 False Alarm Performance 

False alarm rates for the GLR test and the detection filter can 
only be determined via simulation because analytic estimates are not 
available. Some analytic estimates which assume Gaussian noise, no 
disturbances, and no mismodeling are available for the OSGLR algorithm. 
Still, the false alarm rates for the OSGLR algorithm due to disturbances 
and mismodeling would have to be determined by simulation. However, 
determining even large false alarm rates using simulation is difficult 
because of the limited number of conditions that can be tested and the 
large computational burden. 

Specific false alarm rates were not determined for all of the 
algorithms. Thresholds were not selected in all cases and even if they 
had been, the simulation test cases were of insufficient number to be 
able to estimate any false alarm rates. Instead, the false alarm per- 
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formance of each of the algorithms will be qualitatively assessed by its 
sensitivity to noise, turbulence, and modeling errors. Algorithms that 
are sensitive to these effects can be expected to have larger false alarm 
rates than algorithms that are less sensitive. 

The OSGLR and GLR algorithms were least sensitive to noise and 
turbulence. This is true for two reasons: the system model incorporated 

into these algorithms included a turbulence model, and a Kalman filter is 
used to provide an estimate of the state. The OSGLR test was more 
sensitive to modeling errors than the GLR test. 

The unmodified detection filter is sensitive to turbulence and 
modeling errors. The modified detection filter is sensitive to modelling 
errors and very sensitive to turbulence. As mentioned previously, the 
modified detection filter would require dynamic thresholds or a method of 
estimating the nominal no-failure residuals caused by severe turbulence 
and modeling errors to compensate for its sensitivity to these errors and 
disturbances. 

7.6 Detection Time 

The failure detection times depend on the magnitude of the fail- 
ure, the sensor noise, the disturbances present, and the thresholds 
selected. While the detection times were comparable for all of the 
algorithms, the GLR and OSGLR algorithms were tested in severe turbulence 
as opposed to the detection filter algorithms which were tested in minor 
turublence. Detection times for the GLR and OSGLR algorithms were on the 
order of a half-second or less for .01745 rad (1®) elevator and right 
aileron bias failures in severe turbulence for the thresholds 
selected (cf. Table 5.3). 

Higher thresholds would probably be required to provide adequate 
false alarm performance. Even with higher thresholds, detection times 
should be on the order of a second. If the same thresholds are used for 
detecting rudder failures as for other control surface failures. 
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detection times would be much longer since the rudder decision functions 
are smaller than the other control surface decision functions for the 
same magnitude failure. However, as the effects of mismodeling affect 
the rudder decision functions less than the other decision functions, 
smaller thresholds could be used, allowing the rudder detection times to 
be on the same order. 

Detection times for both the modified and unmodified detection 
filters also depend on the filter eigenvalue chosen and the time constant 
of the low-pass filter, if any, required to suppress noise in the resid- 
ual. Thresholds were not chosen for the detection filter. The detection 
times were estimated based on the time delay between failure onset and a 
clear indication that a failure has occurred. For the unmodified 
detection filter, approximately two seconds would be required to detect a 
0.0349 rad (2®) elevator or right aileron failure in minor turbulence 
with the residual being low-pass filtered with a time constant of one 
second. A 0.0349 rad (2®) rudder failure would take a second longer. 
Harder failures could be detected faster as much less, if any, filtering 
would be necessary. On the other hand, the detection and isolation of 
small magnitude failures would require heavy low-pass filtering for noise 
suppression which would impact the failure detection time because of the 
relatively long time required to reach steady state. Detection times for 
the modified detection filter would be on the same order as for the 
unmodified detection filter. 

7.7 Computational Burden 

The computational burden of all of the algorithms has not been 
quantitatively determined. Yet, some approximate comparisons will be 
made here. Each of the algorithms consists of a filter of the system to 
generate a residual, some type of residual processing, and a test for 
failures. The filter portion of each algorithm is computationally 
equivalent. Therefore, the relative computational burden can be deter- 
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mined by examining the computations required to process the residual and 
to test for the failure* 

The least additional computations are required by the unmodified 
detection filter* The residual processing would likely consist of 
several banks of low-pass filters to give the algorithm the ability to 
quickly detect hard failures and still detect soft failures* To test for 
a failure, the residual must be projected onto the failure signature 
plane segment for each control surface* 

The modified detection filter requires slightly more computational 
processing them the detection filter* The additional computations result 
from the secondary filtering of the residual which restores the property 
of a unidirectional residual in response to a control surface failure* 
However, fewer computations are required to project the residual onto a 
signature direction them onto plane segments* 

The relative computational burden of the OSGLR algorithm is 
primarily determined by the number of actuators or control surfaces and 
by the number of terms in the series used to represent the possible fail- 
ure modes* The residual is used to drive an additional filter for each 
actuator to produce an information vector* The dimension of each of 
these information vectors is the number of terms used in the series 
expansion to represent the failure mode* The test for a failure in each 
actuator or control surface is the information vector weighted by an 
information matrix* For the time-invariant case considered here, the 
information matrix is a constant matrix. For a large number of both 
actuators and terms used in the series, the computational burden would be 
very heavy* However, keeping only the first six terms of the series 
expansion was found to be adequate in the present application* In addi- 
tion, only six control surfaces were considered in this evaluation* 

Still, for this case, the computational burden of the OSGLR algorithm is 
at least 50% greater than the unmodified detection filter* 
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The relative computational burden for the GLR algorithm is mainly 
a function of the number of actuators, the number of failure modes 
modeled, cuid the data window chosen. Each actuator requires N correla- 
tion receivers for each failure mode modeled where N is the length of the 
data window divided by the time step. For a half second window and a 
0.02 second time step, 25 correlation receivers would be required per 
actuator per failure mode. For six actuators and only modeling the bias 
failure mode, 150 correlation receivers were required for this applica- 
tion. With 150 correlation receivers, the GLR algorithm was more 
computationally costly than the OSGLR algorithm. However, a half second 
window was too short for adequate FDI performance. A realistic data 
window of two seconds perhaps would make the GLR algorithm computational- 
ly very expensive. Table 5.4 indicates that it requires approximately 18 
times more computation than the OSGLR test. 

7.8 Robustness 

As each of the algorithms considered here relies upon a linear 
model of the system to detect and isolate failures, these algorithms will 
be sensitive to modeling errors. The OSGLR test was shown to be more 
sensitive to modelling errors than the GLR test in Section 5.4.6. The 
unmodified detection filter was unable to detect a right aileron (0.0349 
rad or 2® bias) failure with the aircraft flying at an off-nominal cruise 
condition. Modeling errors caused the modified detection filter to 
produce large residual projections. 

Another source of modeling errors for the GLR and OSGLR algorithms 
are the failure mode models incorporated into each of the algorithms. 

The OSGLR algorithm is likely to be robust to actuator failure mode 
modeling errors as the model is sufficiently general to represent most 
modes adequately. However, the GLR algorithm required specific models of 
failure modes such as bias failures. As only bias failures were modeled 
in the present application, the GLR algorithm is likely to be less robust 
to other failure modes than the other three algorithms. 
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7*9 Maturity 


The GLR algorithm is mature in both theory and in application* 

The OSGLR algorithm is almost as mature in theory as the GLR algorithm. 
However, as the OSGLR test is a recently developed FDI algorithm, there 
is very little experience in applying it. 

Detection filter theory is mature for restructurable controls appli- 
cation to linear, time-invariant systems with no input- to-output 
coupling. However, no theory exists for applying the detection filter to 
time-varying systems. In addition, for systems with input- to-output 
coupling, systematic methods of using the extra degrees of freedom in the 
gain matrix calculation (which result from having more measurements than 
states) and scaling to improve detection filter performance are needed. 
Finally, there is limited experience in applying the detection filter 
with only a couple of applications having been reported. 

The modified detection filter, developed for this application, 
needs additional investigation to be considered mature in both theory and 
application. The problems of time-varying systems, improving performance 
through scaling, and the extra degrees of freedom in the gain matrix 
calculation mentioned above for the detection filter also apply to the 
modified detection filter. 

7.10 Conclusions 

The eight issues addressed in this memorandum are summarized in 
Table 7.1. The GLR and OSGLR algorithms performed the best, especially 
in severe turbulence. However, the computational burden of the GLR 
algorithm is heavy and its ability to isolate wing surface failure modes 
is uncertain. An additional advantage of the OSGLR algorithm is that 
analytic false alarm rate results are available. The most significant 
advantage of the detection filter algorithms is their relatively low 
computational processing requirements. If the sensitivity of the 
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Table 7.1 • Comparison of FDI Algorithms 
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*The comparison is based on the test cases used to evaluate each algorithm during the course of this study 
Only a limited number of flight conditions and environments were simulated. Also, the comparison 
is qucilitative as thresholds were not chosen in all cases and a general detection and isolation logic 
was not selected. 
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detection filter algorithms to turbulence could be reduced, their 
performance might be comparable to the GLR and OSGLR algorithms* 
However, until this is accomplished, the OSGLR algorithm is the most 
promising of these four algorithms evaluated. 
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SECTION 8 


AUGMENTATION OF ANALYTIC FDI SCHEMES FOR IDENTIFYING FAILURES 
IN FUNCTIONALLY REDUNDANT CONTROL SURFACES 


8.1 Introduction 

A second program task is to develop a system monitoring strategy 
to implement the failure detection and isolation techniques which identi- 
fies the mix of sensors and analytic redundancy required. Issues 
associated with this second task are discussed in this section. It has 
been shown that analytic FDI schemes can have difficulty in fully 
isolating failures among control surfaces that are functionally 
redundant. Thus, it was difficult to decide between flap and aileron as 
the failed wing surface. The quantitative measures developed to 
determine the maximum discrimination of such failures showed the inherent 
difficulty. It can be expected then that any intentional maneuvering for 
the purpose of isolating failures of such surfaces using analytic FDI 
would be of only limited value, even if practical otherwise. 

The value of actually isolating a failure of a surface that is 
functionally redundant might be questioned to some degree. After 
a surface fails, it is required that sufficient capability remain to end 
the flight in an acceptable way. If there is sufficient capability (and 
if this can be appropriately determined) then complete failure isolation 
might be considered optional. But there could be reasons why isolation 
to a specific surface would be preferred. It is likely that a failure 
could be more quickly and appropriately compensated if it were fully 
isolated. Moreover, full isolation might allow for more flexibility and 
confidence in continuing a flight after a failure has occurred. 
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There should be thorough investigation of the merits of dispensing 
with complete isolation when functional capability can be reasonably 
assured. There has been some consideration of in-flight dynamics testing 
(Reference 14) and at least a limited demonstration (Reference 15). 
Pre-flight dynamic testing has been standard for military aircraft 
(Reference 15). Dynamic testing could eventually provide information 
quickly and accurately on functional capability of the aircraft while in 
flight. In what follows, however, full isolation capability is taken as 
the simpler and more desirable option. 

A discussion of fault tolerance in current aircraft actuation 
systems and of the role of analytic FDI schemes follows. Augmenting 
analytic schemes with direct measurements of control surface position is 
also considered. 

9*2 Fault Tolerance in Current Aircraft Actuators 

Direct duplication of actuation has been the practice for most 
military and large commercial aircraft for quite some time. Whole 
actuation channels may be duplicated several times. There have been 
several methods devised for dealing with failures of elements in these 
channels. The subsystems and channels must be substantially identical in 
order to give the same control inputs and to enhance the performance of 
the system. Some differences are inevitable because of tolerances, and 
these must be taken into account so that disengagement of a channel will 
occur only under genuine failure conditions. The performance of the 
subsystems and channels is continuously adjusted, in a process called 
equalization (Reference 16). As a part of equalization, inter-channel 
differences are minimized through feedback. If a difference is too 
great, then the failed channel is disengaged or bypassed. Frangible 
elements (shear pins, for example) have also been used, allowing a jammed 
actuator to be broken by the others. Thus, a large degree of actuator 
FDI (and reconfiguration) already takes place on a local level, before 
the surface has actually been moved. This can be expected to continue. 
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8.3 


The Role of Analytic FDI 


Analytic FDI schemes, such as those evaluated in this program, 
look for control surface failure signatures in the whole-system 
dynamics. That they detect failures at the system level (ultimately the 
most important one) is what makes these schemes potentially of great 
value. They can be considered most useful in the context of aircraft 
actuator FDI in identifying failures that the lower-level FDI schemes 
have missed. Such failures might include inaccuracy or breakdown of the 
local schemes and actual physical damage to the control surface itself. 
Outputs from the local automatic schemes might be of some use in 
augmenting the analytic algorithms for the purpose of identifying certain 
types of failures. However, it can be expected that this information 
could be of limited value in detecting and isolating some significant 
failures. 

8.4 Augmentation of Analytic FDI Schemes with 

Actuator Position Measurements 

The concern here is with failures that manifest themselves in some 
way in the system dynamics. It is reasonable to assume that the local 
FDI scheme, having failed to identify and compensate, is not an 
independent source of information to the overall FDI strategy. Such 
"failures" as actuator bias, jamming, or inappropriate overall actuation 
gain might be identifiable through use of surface position transducers. 

Position sensors mounted on or near the control surface itself could 
be considered to provide failure information on a level just below that 
of the whole system. Information from these transducers can be expected 
to be reasonably easy to obtain and use. Position transducers of the 
synchro, potentiometer, and linear variable differential (LVDT) types 
have been extensively used and are simple (Reference 17). To have these 
position transducers be an independent source of information on any type 
of failure, however, they should not be part of the actual flight control 
loop. 
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since WWII, position transducers have provided feedback in 
aircraft flight control systems (Reference 18). They have typically been 
mounted on primary or secondary actuation output shafts* There, they 
could be used for limiting and nulling control as actuator positioning 
commands were satisfied* The currently favored Control Augmentation and 
Fly-By-Wire flight control systems have as a primary characteristic that 
the flight control loops are no longer closed using actuator position 
information but using information from aircraft attitude and position 
sensors (Reference 18)* Depending upon the extent of their continued use 
in the flight control system, actuator position sensors could serve as 
more or less independent sources of PDI information* 

Flight control systems in which control loops are closed using 
aircraft dynamic information will automatically compensate for some 
actuator failures, such as small surface bias errors* To identify larger 
biases, comparing actuator position expected (using a reference model) 
with that actually measured by position transducers might suffice to iso- 
late a failed surface* Alternately, in a separate actuator positioning 
flight control mode in secure flight conditions, commanding the surface 
to move to some absolute position or to more a certain fixed amount could 
suffice to detect and isolate biases or incorrect gains* If the surface 
is jammed, FDI using outputs from position transducers is also possible, 
using similar tests* 

Employing an FDI scheme based on surface position measurements 
involves additional hardware and perhaps the design of separate flight or 
test modes* It should be stressed, too, that position transducers would 
still be of only limited use in identifying certain types of failures, 
such as actual control surface damage* 

Position sensors could be used as a primary source of FDI informa- 
tion, with position measurements obtained continually* Actuator position 
information could also be used on some lower FDI decision level* If a 
sensitive whole-system FDI scheme were available, however - and this 
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would ideally be preferred - then direct surface position sensors could 
be used in augmentation to provide information for complete failure 
isolation, eliminating the uncertainties inherent in fully identifying 
the failure of a functionally redundant surface. Only a limited number 
of transducers might then be required, and limited use made of their 
information. Use of position sensors to augment analytic FDI schemes 
also implies that each scheme could serve as a limited check on the 
other. 


8.5 Conclusions 

It has been shown that analytic FDI schemes can have difficulty in 
isolating failures among functionally redundant control surfaces. 

Complete isolation might not be needed if the presence of adequate 
functional capability can be determined quickly and accurately. This 
point deserves more investigation. Full isolation might lead to simpler 
or better compensation for a failure, however. Then, depending upon the 
type of usage of control surface position transducers in the flight 
control system, they can be used to provide information for identifying 
actuator failures. Analytic FDI schemes will always be of great value as 
they detect failures based on whole-system dynamics. Where they cannot 
fully isolate a failure, actuator position information could be useful. 

Whether actuator position transducers can provide useful augmenta- 
tion to analytic FDI schemes for the C-130 should be investigated. The 
role that such transducers now have in the flight control system should 
first be determined. Then, if they are not a primary part of the flight 
control loop, selective addition of the sensors should be considered, 
starting with the wing surfaces so that their failures can be fully 
isolated. 
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SECTIC»I 9 


SUMMARY AND CONCLUSIONS 


This report has described work performed with regard to the eval- 
uation of FDI algorithms for application to aircraft res true turable 
control systems. Three algorithms were evaluated: the detection filter, 

the Generalized Likelihood Ratio test and the Orthogonal Series General- 
ized Likelihood Ratio test. In addition, a modification to the detection 
filter, to produce unidirectional failure residuals for systems with 
direct input-output coupling, was also investigated. This modification 
is relevant since the use of accelerometer measurements for FDI in 
aircraft systems results in direct input-output coupling. The algorithms 
were evaluated and compared using results from a nonlinear simulation of 
a C-130 aircraft. The issue of the distinguishability of failures was 
also addressed and measures defined which permit an a priori determina- 
tion of the ability to do this for a specific system. Considerations in 
the development of a system monitoring strategy were also discussed. 

The major conclusion which may be drawn from the results of this 
study is that algorithmic failure detection and isolation may be feasible 
for res true turable control applications. This conclusion must be quali- 
fied by the results obtained during this study, \^ich have been basically 
limited to a single operating condition and to the investigation of a 
small subset of the potential failures. In particular, failure detection 
does not appear to be a problem. Each of the algorithms was able to 
detect small elevator, rudder, aileron and flap failures for the C-130 
aircraft in turbulence. The isolation of control surface failures was 
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not a problem for elevator and rudder failures. However, difficulties 
arose in the isolation of wing surface, i.e., aileron and flap, 
failures. These failures have a similar effect on the responses of the 
aircraft system. The OSGLR algorithm performed best in this regard and 
the isolation of these failures was possible, although a relatively long 
time was required to do this. It was difficult to isolate these failures 
with the other algorithms, at best, and it was shown that false isolation 
may occur with the GLR test. This conclusion highlights the potential 
need to augment the analytic FDI algorithms with the direct measurement 
of failures using, for example, position sensors for some of the control 
surfaces. 

The OSGLR algorithm performed best of those evaluated. The nature 
of the algorithm and its basis upon a series expansion implies that most 
failure modes should be detectable. All failure types investigated 
during this study were detected and were isolated, although there was a 
long time delay associated with the wing surface failures. Bias failures 
on the order of a degree of surface deflection were detected in less than 
a half a second for a system without modeling errors. The computational 
burden associated with this algorithm is moderate relative to the others, 
its false alarm rate can be analytically estimated and the theory 
associated with it is mature. On the negative side, the robustness 
properties of the OSGLR test are poor but so are those of the other 
algorithms. In addition, the OSGLR algorithm has not been previously 
Sipplied to any system. 

The GLR algorithm also performed well in the C-130 application. 

The major drawbacks associated with it are its heavy computational burden 
and the uncertainty associated with its ability to isolate wing surface 
failures. The most significant advantage of the detection filter algor- 
ithms is their relatively low computational processing requirements. If 
the sensitivity of these algorithms to turbulence could be reduced, their 
performance might be comparable to the GLR and OSGLR algorithms. 
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APPENDIX A 


C-130 LINEAR MODEL DEVELOPMENT 


A.1 Introduction 

Each of the FDI algorithms investigated under the Res true tur able 
Controls Program requires a linear model of the nonlinear system for 
design or implementation. The linearization technique used to generate 
linear models of the C^130 aircraft dynamics is described and some 
comparisons of the linear model and the nonlinear system are presented. 

A. 2 Linearization Technique 

The nonlinear system consists of dynamics which describe the 

motion of the aircraft and output equations which describe the 
measurements as functions of the states and the controls. The nonlinear 
dynamics can be functionally represented by 

X = (A.1) 

The output equations are of the form 

y = i[(x,\i) (A. 2) 

The outputs of the linear model were chosen to be airspeed, 
acceleration at the eg along the y and z body axes, angular velocity 
about the body axes, attitude, and altitude. The inputs of the linear 
model are a subset of the inputs for the nonlinear model. The inputs 
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chosen for the linear model include the elevator, rudder, left and right 
aileron, and left and right flap where each aileron and each flap is 
allowed to move independently of the other aileron or flap. Elevator 
trim tabs and engine throttle setting were not included as elevator trim 
tab and engine failures were not considered. The states chosen for the 
linear model differ slightly from the nonlinear system. Airspeed, angle 
of attack, and sideslip angle were selected to be states of the linear 
model instead of the velocities along each of the body axes. The reason 
for choosing airspeed, angle of attack, and sideslip angle was that there 
is a closer relationship between these three variables and the first 
three measurements mentioned previously (airspeed and the acceleration 
along the y and z body axes). 

To develop a linear model, the nonlinear system is expanded in a 
Taylor series about a nominal point neglecting second and higher 

order terms. 


3f 9f 

X = ^ - X ) + (x ,u )(u - u ) (A. 3) 

— Q — Q — O — o — — O dU —0—0 — — O 


3g 3g 

y = “ X ) + (x ,u )(u - u ) (A. 4) 

— — o — o 3x — o — o — — o 3u — 0—0 — — o 


To put Eq. (A. 3) and (A. 4) in more standard form, define 


Ax 


x - X 
— — o 


(A. 5) 


Au = u - u 


(A. 6) 


3f_ 


(A.7) 


B 


(x ,u ) 
3u — 0—0 


(A. 8) 
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(4.9) 

Also, differentiate Eq. (A. 5), assuming the nominal point remains fixed. 

• • 

^ = 3C 

Combining Eq. (A. 3) through (A.11) results in the form 

Ax = f(x ,u ) + AAx + BAu (A.11) 

*— — — O —“O — — 

y = + dau (a. 12 ) 

"^O '""O — — 


The A, B, C, and D matrices which describe the linear model can 
either be calculated by amalytically determining the partial derivatives 
and then evaluating the partial derivates or by numerically approximating 
the partial derivatives about the nominal point. As the C-130 nonlinear 
dynamics contain many lookup tables as opposed to explicit functions of 
the states and the controls, the partial derivatives were numerically 
approximated in the following manner* Define Xj^ to be the ith state, 
fi( 3 c,ia) to be the nonlinear function which describes the derivative of 
the ith state, and j]j^ to be a column vector with unity in the ith row 
and zero in the other rows* Let aj^j be the element in the ith row and 
the jth column of the A matrix* Then a^j is numerically approximated 
by 


a. . 
^3 


3f. 

- 5 -^ (x ,u ) 

dX . — O — O 

D 


^4 '2L.) - f . (x - n.x. ,u ) 

E P 

2 x. 

3^ 


(A*13) 
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where Xj^ is a perturbation in jth state from the nominal. This 
perturbation must be chosen to produce a good approximation to the 
partial derivative. The B, C, and D matrices were calculated similarly. 

Figures A,1 and A, 2 present simulation runs which compare the 
linear and nonlinear system responses. The nominal point used to 
generate the linear model is with the C-130 aircraft flying straight and 
level with an airspeed of 77.2 m/s (150 knots) at an altitude of a 
304,8 m (1000 ft). Figure A,1 investigates the quality of the A matrix 
linearization by perturbing only the states. The nonlinear and linear 
response for perturbations in airspeed, angle of attack, sideslip angle, 
and the angular velocity of the vehicle expressed in the body coordinate 
system are compared. The dynamics are well represented although the 
linear and nonlinear models begin to diverge after about 60 s. There 
are, however, nonlinear dynamics which are poorly represented. In the 
nonlinear system, a perturbation in the lateral dynamics also excites the 
longitudinal dynamics while the linear model is unable to represent this 
cross-»coupling because of the nonlinearities involved. 

Figure A, 2 presents comparisons of linear and nonlinear responses 
for a perturbation in the rudder control input. Note the small changes 
in most of the states and outputs. The quality of the linear response is 
dependent on roll. Once roll becomes "large", the cross-coupling between 
the lateral and longitudinal dynamics causes the linear response to 
diverge from the nonlinear response. 
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ALTITUDE YAW ANGLE PITCH ANGLE ROLL ANGLE 

m(ft) rad (deg) rad (deg) rad (deg) 

243.84 3.49 - 0.0349 0.1047 0.698 

( 800 . 0 ) 0.0 ( 200 . 0 ) (- 2 . 0 ) ( 6 . 0 ) 0.0 ( 40.0 



0.00 20.00 40.00 60.00 80.00 100.00 120.00 

TIME (SEC) 



0.00 20.00 40.00 60.00 80.00 100.00 120.00 

TIME (SEC) 
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+ nonlinear system response 
X linear system response 

Figure A.l. Linear and nonlinear response for perturbations in 
airspeed, angle of attack, sideslip angle, and the 
angular velocities (Cont.) 
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APPENDIX B 


THE DISCRETE-TIME DETECTION FILTER 


As the detection filter was implemented on a digital computer, the 
detection filter was designed as a discrete-time system. While detection 
filter theory is not strictly valid for discrete— time systems, a satis- 
factory design is possible if the sampling rate is sufficiently rapid. 
This appendix will simply state the extension to discrete time. For more 
detail and explanation, see Reference 8. 

The first step in designing a discrete- time detection filter is to 
describe the continuous linear model 


X = 

Ax + 


(B.1 ) 

y = 

Cx + 

Dy 

(B.2) 


as a discrete-time system. This is commonly done by converting the state 
differential equation into a difference equation. This conversion 
results in a discrete-time model of the form 


2c(k+1 ) = fe(k) + IM(k) 


(B.3) 


y(k) 


Cx(k) + Du(k) 


(B.4) 


where _x(k), ^(k), and ^(k) are the state, input, and measurement vectors 
at sampling time t^. For constant sampling interval. At, the sampling 
time may be expressed as t^ = k*At where k = 0,1,2,3,...* The matrix $ 
is referred to as the state transition matrix as it describes how the 
state propagates independent the effect of the control inputs over the 
sampling interval At, The input matrix, r, describes the effect of the 
control vector on the state over the sampling interval. only 

changes at the sampling times t^, then the state difference equation, 

Eq. (B.3), exactly represents the state differential equation, Eq. 

(B.1). However, if u^(t) is changing over the sampling interval, Eq. 

(B.3) only approximates Eq. (B.l). In this case, the sampling interval 
At must be sufficiently small so that the assumption of u(t) being 
constant over the sampling interval is valid. The sampling interval 
chosen for design and implementation of the detection filter in this memo 
was 20 milliseconds. With this sampling interval, the control input 
vector _u(t) should be approximately constant over the interval. 

Given the discrete— time linear model, the detection filter proper- 
ties and design are analogous to the continuous-time case presented in 
Section 3. Only actuator failures for the case where there is input- 
output coupling will be considered here. Consider a failure in the ith 
actuator. Before, the actual control surface deflections, u(t), were 
expressed as the sum of the expected control surface deflections input to 
the detection filter, ^(t), and the unexpected ith control surface de- 
flection n(t). Now, jj(t), ^'(t), and n(t) will be assumed to be piece- 
wise constant functions, only changing at sampling times t . Therefore, 
the actual control surface deflection at t^^ is 

u(k) = u'(k) + e^n(k) (B.5) 
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where ii'(k) and n(k) are the expected control surface deflection to the 
detection filter and the difference between the actual and expected ith 
control surface deflection at sampling time t^^, respectively. Again, e. 
is a column vector with zeros in every row except for a one in the ith 
row. The discrete-time error dynamics produced by this failure are 

q(k+1) = ($ - KC)q(k) + (j^ - Kd^)n(k) (B.6) 

r(k) = CgCk) + d^n(k) (B.7) 

where ^(k) and ^(k) are the discrete filter state error and residual 
respectively, is the ith column of the T matrix. 

If a detection filter can be designed for this system and if u(t), 
ti'(t), and n(t) only change at sampling times tj^ such that Eq, (B.5) is 

satisfied, the - Kd^) term in Eq. (B.6) will produce a unidirectional 

residual. The direction of the residual will be C(y. - Kd.). Therefore, 

-1 -1 ' 

the signature produced by a failure in the ith control surface can be 
constrained to a plane spanned by C(y^ - K d^) and d^. This is 
identical to the continuous-time results presented in Section 3.2 except 
that the ith column of the continuous input matrix, b^, has been replaced 
by the ith column of the discrete input matrix, y^. However, u(t), 

ji’(t), and n(t) have been assumed to be piecewise constant functions 

changing at the sampling times t^^. As before, the sampling interval must 
be sufficiently small so this assmption is valid. 

For a fully measured system, there are only two minor differences 
in designing a discrete detection filter as compared to designing a 
continuous detection filter (presented in Section 3.3). 

(1) The filter eigenvalue must be chosen in discrete-time domain. 

(2) The gain matrix K must be calculated to satisfy the 
relationship 

* - KC = XI 
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